Exploit for Server-Side Request Forgery in Sap Businessobjects Business Intelligence Platform

CVE-2020-5902 CVE-2020-6308

githubexploit · 2020-12-30

Description

Server-Side Request Forgery in Sap Businessobjects Business Intelligence Platform CVE-2020-6308-mass-exploite

Entry point

ParameterfileName · path

Pathtmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp

Directory traversal leading to unauthorized file read via fileRead.jsp.

Affected software

f5 Big-ip Access Policy Manager< 11.6.5.2, 12.1.5.2, 13.1.3.4, 14.1.2.6, 15.0.1.4, 15.1.0.4

f5 Big-ip Advanced Firewall Manager< 11.6.5.2, 12.1.5.2, 13.1.3.4, 14.1.2.6, 15.0.1.4, 15.1.0.4

f5 Big-ip Advanced Web Application Firewall< 11.6.5.2, 12.1.5.2, 13.1.3.4, 14.1.2.6, 15.0.1.4, 15.1.0.4

f5 Big-ip Analytics< 11.6.5.2, 12.1.5.2, 13.1.3.4, 14.1.2.6, 15.0.1.4, 15.1.0.4

All known vulnerabilities by product

F5 Big-Ip Sap Businessobjects Business Intelligence Platform

CVSS Score

10.0

HIGH SEVERITY

Version 2.0

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Working code

89%confidence this exploit runs

Based on 2 file(s) in the source

EPSS Score

100.0%higher than 100.0% of all CVEs

Updated 2026-06-16

Exploit Details

Modified:2021-02-08 13:43

Last Seen:2025-08-31 20:46

Reporter:freeFV

Last commit:2020-11-24

Tags

exploitserver-side request forgerysapbusiness intelligence platformCVE-2020-6308

Other exploits for the same CVE

2026-06-30 fahriamuraGITHUB

Exploit for Path Traversal in F5 Big-Ip_Access_Policy_Manager

2026-03-13 retongle-devGITHUB

📄 F5 BIG-IP TMUI Unauthenticated Remote Code Execution

2026-03-09 indoushkaPACKETSTORMRuby

Exploit for Path Traversal in F5 Big-Ip_Access_Policy_Manager

2025-07-27 mirrors_jas502nGITEE

F5 BIG-IP TMUI Directory Traversal / File Upload / Code Execution Exploit

2023-11-14 metasploitZDTRuby

F5 BIG-IP TMUI Directory Traversal / File Upload / Code Execution

2023-11-14 wvu, Mikhail Klyuchnikov, metasploit.comPACKETSTORMRuby

Exploit for Path Traversal in F5 Big-Ip_Access_Policy_Manager

2022-05-28 west9bGITHUB

Exploit for Path Traversal in F5 Big-Ip_Access_Policy_Manager

2022-03-11 KennysGITEE

Exploit Code

README6 lines

## https://sploitus.com/exploit?id=350E6199-FA83-5A2F-91D3-19E2D2921801
# CVE-2020-6308-mass-exploiter
CVE-2020-6308 mass exploiter/fuzzer.


usage: CVE-2020-5902-mass-exploiter.py -l list.txt -w workers