airVision NVR path Parameter Traversal Arbitrary File Access

medium Nessus Plugin ID 64994

Language:

Synopsis

The remote web server hosts an application that is affected by a directory traversal vulnerability.

Description

The remote web server hosts airVision NVR, an application used to remotely monitor IP cameras. The installed version of airVision NVR fails to properly sanitize user-supplied input to the 'path' parameter of the 'views/file.php' script. This could allow an unauthenticated, remote attacker to read arbitrary files on the remote host by sending a request containing directory traversal characters.

Note that the application is reportedly also affected by a SQL injection vulnerability as well as an additional traversal arbitrary file disclosure vulnerability via the 'path' parameter of the 'views/image.php' script; however, Nessus has not tested for these additional issues.

Solution

Unknown at this time.

Plugin Details

Severity: Medium

ID: 64994

File Name: airvision_nvr_path_file_disclosure.nasl

Version: 1.10

Type: remote

Family: CGI abuses

Published: 3/4/2013

Updated: 1/19/2021

Risk Information

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.5

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Temporal Vector: E:POC/RL:U/RC:ND

Vulnerability Information

CPE: cpe:/o:ubnt:airvision_firmware

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Vulnerability Publication Date: 10/15/2012

Reference Information

BID: 55921

EDB-ID: 21990