.. / CVE-2018-14064

• LFI
• Nuclei
• Web

Exploit for VelotiSmart Wifi - Directory Traversal (CVE-2018-14064)

Description:

VelotiSmart WiFi B-380 camera devices allow directory traversal via the uc-http service 1.0.0, as demonstrated by /../../etc/passwd on TCP port 80.

Nuclei Template

View the template here CVE-2018-14064.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2018/CVE-2018-14064.yaml

References: