.. / CVE-2017-9833

Exploit for BOA Web Server 0.94.14 - Arbitrary File Access (CVE-2017-9833)

Description:

BOA Web Server 0.94.14 is susceptible to arbitrary file access. The server allows the injection of “../..” using the FILECAMERA variable sent by GET to read files with root privileges and without using access credentials.

Nuclei Template

View the template here CVE-2017-9833.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2017/CVE-2017-9833.yaml
Copy

References:

https://www.exploit-db.com/exploits/42290
https://github.com/ARPSyndicate/kenzer-templates
https://pastebin.com/raw/rt7LJvyF
https://nvd.nist.gov/vuln/detail/CVE-2017-9833
https://www.exploit-db.com/exploits/42290/