CVE-2019-9649

Related Files

CoreFTP Server MDTM Directory Traversal

Posted Aug 23, 2019

Authored by Kevin Randall | Site metasploit.com

An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote attacker can use a directory traversal (..\..\) to browse outside the root directory to determine the existence of a file on the operating system, and the last modified date.

tags | exploit, remote, root, file inclusion

advisories | CVE-2019-9649

SHA-256 | 02a55797ad317b26e2c3f852933ef7c93cfeefe8fa481fb85daa30044a0ac1f7

Download | Favorite | View

CoreFTP Server FTP / SFTP Server 2 Build 674 MDTM Directory Traversal

Posted Mar 11, 2019

Authored by Kevin Randall

CoreFTP Server FTP and SFTP Server version 2 build 674 suffer from a directory traversal vulnerability. By utilizing a directory traversal along with the FTP MDTM command, an attacker can browse outside the root directory to determine if a file exists based on return file size along with the date the file was last modified by using a ..\..\ technique.

tags | exploit, root

advisories | CVE-2019-9649

SHA-256 | 3fc201ddb80ecf5d371328f76f120d416014c22afdf01a082fc0fd2b76a60e8a

Download | Favorite | View