tecrail responsive filemanager 9.13.4 vulnerabilities and exploits

(subscribe to this query)

upload.php in Responsive FileManager 9.13.4 and 9.14.0 allows SSRF via the url parameter because file-extension blocking is mishandled and because it is possible for a DNS hostname to resolve to an internal IP address. For example, an SSRF attempt may succeed if a .ico filename i...

Tecrail Responsive Filemanager 9.13.4 Tecrail Responsive Filemanager 9.14.0

tecrail Responsive FileManager 9.13.4 allows remote malicious users to delete an arbitrary directory as a consequence of a paths[0] path traversal mitigation bypass through the delete_folder action in execute.php.

Tecrail Responsive Filemanager 9.13.4

tecrail Responsive FileManager 9.13.4 allows remote malicious users to delete an arbitrary file as a consequence of a paths[0] path traversal mitigation bypass through the delete_file action in execute.php.

Tecrail Responsive Filemanager 9.13.4

tecrail Responsive FileManager 9.13.4 allows remote malicious users to read arbitrary file via path traversal with the path parameter, through the get_file action in ajax_calls.php.

Tecrail Responsive Filemanager 9.13.4

tecrail Responsive FileManager 9.13.4 allows remote malicious users to write to an arbitrary file as a consequence of a paths[0] path traversal mitigation bypass, through the create_file action in execute.php.

Tecrail Responsive Filemanager 9.13.4

tecrail Responsive FileManager 9.13.4 allows remote malicious users to write to an arbitrary image file (jpg/jpeg/png) via path traversal with the path parameter, through the save_img action in ajax_calls.php.

Tecrail Responsive Filemanager 9.13.4

tecrail Responsive FileManager 9.13.4 allows remote malicious users to read arbitrary files via path traversal with the path parameter, through the copy_cut action in ajax_calls.php and the paste_clipboard action in execute.php.

Tecrail Responsive Filemanager 9.13.4

tecrail Responsive FileManager 9.13.4 allows XSS via a media file upload with an XSS payload in the name, because of mishandling of the media_preview action.

Tecrail Responsive Filemanager 9.13.4

An SSRF issue exists in tecrail Responsive FileManager 9.13.4 via the upload.php url parameter. NOTE: this issue exists because of an incomplete fix for CVE-2018-15495.

Tecrail Responsive Filemanager 9.13.4

/filemanager/ajax_calls.php in tecrail Responsive FileManager prior to 9.13.4 uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize get_file sequences such as ".." that can resolve to a location tha...

Tecrail Responsive Filemanager

1 EDB exploit

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook