CVE-2023-37599 PoC — Issabel PBX 安全漏洞

Description

Directory Listing vulnerability in issabel-pbx 4.0.0-6 exposing application sensitive files

介绍

## issabel-pbx 4.0.0-6 - Directory Listing ###

**Description:**
Issabel-pbx v.4.0.0-6 is vulnerable to Broken Access Control. The Directory Listing vulnerability allows any remote attacker to view the application's sensitive files within the modules directory of the application without any authorization.

**Vulnerable Product Version:**
issabel-pbx 4.0.0-6

**Date:**
10/07/2023

**CVE:** 
CVE-2023-37599

**CVE Author:**
Sahil Ojha

**Vendor Homepage:**
https://www.issabel.org/

**Software Link:** 
https://github.com/IssabelFoundation/issabelPBX

**Tested on:** 
Windows

**Steps to reproduce:**
1.	Navigate to URL: https://{Issabel IP}/module. I found out that many important files of application can be accessed directly from this directory listing.

   ![HTML Render](https://github.com/sahiloj/CVE-2023-37599/blob/main/1.png)
   ---
   
   ![HTML Render](https://github.com/sahiloj/CVE-2023-37599/blob/main/2.png)
   ---

  ![HTML Render](https://github.com/sahiloj/CVE-2023-37599/blob/main/3.png)
   ---
   
   ![HTML Render](https://github.com/sahiloj/CVE-2023-37599/blob/main/4.png)
   ---

文件快照

备注