CVE-2020-15492 PoC — INNEO Solutions INNEO Startup TOOLS 2018 M040 路径遍历漏洞

Source

https://github.com/patrickhener/CVE-2020-15492

Associated Vulnerability

Title: INNEO Solutions INNEO Startup TOOLS 2018 M040 路径遍历漏洞 (CVE-2020-15492)
Description:An issue was discovered in INNEO Startup TOOLS 2017 M021 12.0.66.3784 through 2018 M040 13.0.70.3804. The sut_srv.exe web application (served on TCP port 85) includes user input into a filesystem access without any further validation. This might allow an unauthenticated attacker to read files on the server via Directory Traversal, or possibly have unspecified other impact.

Description

This repository holds the advisory, exploits and vulnerable software of the CVE-2020-15492

Readme

# CVE-2020-15492

This vulnerablity was discovered and disclosed by me. This repository will hold the advisory, exploits and the setup executable of the vulnerable software for one to experiment with this vulnerability.

This repository is only for educational purposes.

# Links

- [Advisory SYSS-2020-028](https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-028.txt)
- [SySS Blog entry](https://www.syss.de/pentest-blog/2020/syss-2020-028-sicherheitsschwachstelle-in-inneo-startup-tools-2017-und-2018/)
- [Exploit on Exploit-DB](https://www.exploit-db.com/exploits/48693)
- [Vendor notice](https://www.inneo.de/files/content/Produktentwicklung/Tools-und-Erweiterungen/Startup-TOOLS/INNEO-SA-SUT-2020-01.pdf)
- [MITRE Entry](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15492)
- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2020-15492)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →