.. / CVE-2017-11165

Exploit for DataTaker DT80 dEX 1.50.012 - Information Disclosure (CVE-2017-11165)

Description:

DataTaker DT80 dEX 1.50.012 is susceptible to information disclosure. A remote attacker can obtain sensitive credential and configuration information via a direct request for the /services/getFile.cmd?userfile=config.xml URI, thereby possibly accessing sensitive information, modifying data, and/or executing unauthorized operations.

Nuclei Template

View the template here CVE-2017-11165.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2017/CVE-2017-11165.yaml
Copy

References:

https://github.com/ARPSyndicate/cvemon
https://www.exploit-db.com/exploits/42313/
https://nvd.nist.gov/vuln/detail/CVE-2017-11165
https://packetstormsecurity.com/files/143328/DataTaker-DT80-dEX-1.50.012-Sensitive-Configuration-Exposure.html
https://www.exploit-db.com/exploits/45094