CVE-2019-13063

moderate-risk
Published 2019-09-23

Within Sahi Pro 8.0.0, an attacker can send a specially crafted URL to include any victim files on the system via the script parameter on the Script_view page. This will result in file disclosure (i.e., being able to pull any file from the remote victim application). This can be used to steal and obtain sensitive config and other files. This can result in complete compromise of the application. The script parameter is vulnerable to directory traversal and both local and remote file inclusion.

Do I need to act?

!
15.9% chance of exploitation in next 30 days
EPSS score — higher than 84% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
47062
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Sahipro

References (4)

Vendor Advisory https://sahipro.com/downloads-archive/
Exploit https://www.exploit-db.com/exploits/47062
Vendor Advisory https://sahipro.com/downloads-archive/
Exploit https://www.exploit-db.com/exploits/47062
44
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 13/34 · Low
Exposure 5/34 · Minimal