Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2023-49031 — LFI Tikit eMarketing v6.8.3.0 (CVE-2023-49031) | Kitploit
Tools/GitHubGitHub/yoshik0xf6/cve-2023-49031
Vulnerability AnalysisExploitationWeb Application ExploitationInformation GatheringPenetration Testing
GitHubyoshik0xf6/cve-2023-49031

CVE-2023-49031

LFI Tikit eMarketing v6.8.3.0 (CVE-2023-49031)

View Repository
11 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

LFI Tikit eMarketing (CVE-2023-49031)

Discovery

On November 2023, a novel local file inclusion vulnerability was identified in the “eMarketing” platform developed by Tikit (now Advanced) during a client engagement. This issue was resolved with Advanced on February 2024

Affected Versions

This vulnerability has only been tested and vulnerable on version 6.8.3.0 screenshot

Attack Vector

The "filename" parameter used by "OpenLogFile" endpoint was found to be not sanitized. An unauthenticated threat actor may leverage this vulnerability to read arbitrary files from the local file system. screenshot

POC

As a Proof-of-Concept (PoC), database credentials were collected from the "web.config" file found on a vulnerable machine. screenshot

Vulnerability Check

An example HTTP GET payload (path + parameters) to read the hosts file on a vulnerable Windows system can be found below:

Download Tool
  • /DATA/Log/OpenLogFile?filename=C%3A%5CWindows%5CSystem32%5Cdrivers% 5Cetc%5Chosts

Remediation

Update to the latest version of eMarketing