module
AlienVault Authenticated SQL Injection Arbitrary File Read
| Disclosed | Created |
|---|---|
| Mar 30, 2014 | May 30, 2018 |
Disclosed
Mar 30, 2014
Created
May 30, 2018
Description
AlienVault 4.5.0 is susceptible to an authenticated SQL injection attack via a PNG
generation PHP file. This module exploits this to read an arbitrary file from
the file system. Any authenticated user is able to exploit it, as administrator
privileges aren't required.
generation PHP file. This module exploits this to read an arbitrary file from
the file system. Any authenticated user is able to exploit it, as administrator
privileges aren't required.
Author
Brandon Perry [email protected]
Platform
Linux
References
Module Options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.