CVE-2018-25178

HIGH

7.5

Description

Easyndexer 1.0 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the file parameter. Attackers can send POST requests to showtif.php with arbitrary file paths in the file parameter to retrieve system files like configuration and initialization files.

Details CVE

Score CVSS v3.17.5

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie3/6/2026

Derniere modification3/16/2026

Sourcenvd

Observations honeypot0

Produits affectes

rul10:easyndexer

Faiblesses (CWE)

CWE-22

References

https://www.exploit-db.com/exploits/45835(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/easyndexer-arbitrary-file-download-via-showtifphp(disclosure@vulncheck.com)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.