0x6b7966/cve-2019-13063-pocProof of concept tool to exploit the directory traversal and local file inclusion vulnerability that resides in the Sahi-pro web application CVE-2019-13063
An issue was discovered in Sahi-pro script manager web-application, there is both a file and directory traversal vulnerability which resides in the ?script= parameter which is found on the /Script_view page of the Sahi-pro webapplication. An attacker can send a specially crafted URL to retrieve and steal sensitive files from the victim.
This is a proof of concept tool to exploit the directory traversal and file traversal vulnerability that resides in the Sahi-pro web application.
Impact: Within the Sahi-pro web-application software, there is a directory and file traversal vulnerability which result in the leakage of sensitive information from the application, or it can be used to pull direct systems files.
The ?script= parameter on the script_view page is susceptible to file and directory traversal to list the contents of files.
Run it like this:
$ python3 CVE-2019-13063-POC.py --url http://example:[REDACTED]
This will download the applications product key.
Specify the full URL, including the file you wish to download appended to the vulnerable ?script= parameter.
usage: CVE-2019-13063-POC.py [-h] [--url URL]
optional arguments:
-h, --help show this help message and exit
--url URL Specify the vulnerable URL
Sahi User properties file - \sahi_pro\userdata\config\userdata.properties
Sahi data profile - \sahi_pro\userdata\browser\ff\profiles\sahi0\prefs.js
Sahi properties file - \sahi_pro\config\sahi.properties
Sahi Product key location - \config\productkey.txt
This script will just attempt to download the entire page, you could easily parse out the wanted content from the page since it is between the unique <ol><li> HTML parameters with a simple bash one liner.
Example to parse out the product key:
cat output.txt | grep "<ol><li>" | cut -d ">" -f3 | cut -d "<" -f1
1a79a4d60de6718e8e5b326e338ae533