CVEs-PoC/2014/CVE-2014-5236.md

CVE-2014-5236

Description

Multiple absolute path traversal vulnerabilities in documentconverter in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allow remote attackers to read application files via a full pathname in a crafted (1) OLE Object or (2) image in an OpenDocument text file.

POC

Reference

• http://packetstormsecurity.com/files/128257/Open-Xchange-7.6.0-XSS-SSRF-Traversal.html

Github

• https://github.com/20142995/nuclei-templates
• https://github.com/cyb3r-w0lf/nuclei-template-collection