White Star Software Protop LFI: When Your Files Take an Unwanted Vacation!
White Star Software Protop 4.4.2 has a Local File Inclusion vulnerability that lets unauthenticated attackers snoop through files like a nosy neighbor. Just a few URL-encoded traversal sequences could expose your secrets. Use the `/pt3upd/` endpoint to see what the fuss is about. But don’t worry, a fix is already issued!
Hot Take:
White Star Software’s Protop has a case of the LFI blues, and it’s not just the jazz kind. It seems that anyone with a penchant for playing “I Spy” with your system files can take a peek under the hood. Time to close that peep show!
Key Points:
- Protop v4.4.2 has a Local File Inclusion (LFI) vulnerability.
- Exploitable through the `/pt3upd/` endpoint using URL-encoded path traversal.
- Unauthenticated attackers can access arbitrary files, including sensitive ones.
- Vendor has issued a fix after being notified.
- CVSS score of 8.2, indicating a high severity vulnerability.
Already a member? Log in here