.. / CVE-2017-14537

Exploit for Trixbox 2.8.0 - Path Traversal (CVE-2017-14537)

Description:

Trixbox 2.8.0.4 is susceptible to path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php.

Nuclei Template

View the template here CVE-2017-14537.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2017/CVE-2017-14537.yaml
Copy

References:

https://sourceforge.net/projects/asteriskathome/
https://secur1tyadvisory.wordpress.com/2018/02/13/trixbox-multiple-path-traversal-vulnerabilities-cve-2017-14537/
https://nvd.nist.gov/vuln/detail/CVE-2017-14537
http://packetstormsecurity.com/files/162853/Trixbox-2.8.0.4-Path-Traversal.html