CVE-2023-37599 PoC — Issabel PBX 安全漏洞

Source

https://github.com/sahiloj/CVE-2023-37599

Associated Vulnerability

Title: Issabel PBX 安全漏洞 (CVE-2023-37599)
Description:An issue in issabel-pbx v.4.0.0-6 allows a remote attacker to obtain sensitive information via the modules directory

Description

Directory Listing vulnerability in issabel-pbx 4.0.0-6 exposing application sensitive files

Readme

## issabel-pbx 4.0.0-6 - Directory Listing ###

**Description:**
Issabel-pbx v.4.0.0-6 is vulnerable to Broken Access Control. The Directory Listing vulnerability allows any remote attacker to view the application's sensitive files within the modules directory of the application without any authorization.

**Vulnerable Product Version:**
issabel-pbx 4.0.0-6

**Date:**
10/07/2023

**CVE:** 
CVE-2023-37599

**CVE Author:**
Sahil Ojha

**Vendor Homepage:**
https://www.issabel.org/

**Software Link:** 
https://github.com/IssabelFoundation/issabelPBX

**Tested on:** 
Windows

**Steps to reproduce:**
1.	Navigate to URL: https://{Issabel IP}/module. I found out that many important files of application can be accessed directly from this directory listing.

   ![HTML Render](https://github.com/sahiloj/CVE-2023-37599/blob/main/1.png)
   ---
   
   ![HTML Render](https://github.com/sahiloj/CVE-2023-37599/blob/main/2.png)
   ---

  ![HTML Render](https://github.com/sahiloj/CVE-2023-37599/blob/main/3.png)
   ---
   
   ![HTML Render](https://github.com/sahiloj/CVE-2023-37599/blob/main/4.png)
   ---

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →