AlienVault Authenticated SQL Injection Arbitrary File Read

AlienVault Authenticated SQL Injection Arbitrary File Read

AlienVault 4.5.0 is susceptible to an authenticated SQL injection attack via a PNG generation PHP file. This module exploits this to read an arbitrary file from the file system. Any authenticated user should be able to exploit it. Administration privileges aren't required.

Module Name

auxiliary/gather/alienvault_iso27001_sqli

Authors

• Brandon Perry <bperry.volatile [at] gmail.com>

References

• EDB-32644

Platforms

• linux

Reliability

• Normal

Development

• Source Code
• History

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use auxiliary/gather/alienvault_iso27001_sqli msf auxiliary(alienvault_iso27001_sqli) > show actions ...actions... msf auxiliary(alienvault_iso27001_sqli) > set ACTION <action-name> msf auxiliary(alienvault_iso27001_sqli) > show options ...show and set options... msf auxiliary(alienvault_iso27001_sqli) > run