Description
Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET request to the /setup page to access the exposed root_path value rendered in the HTML response, which enables exploitation of path-dependent vulnerabilities such as relative path traversal in connector.php.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| thexerteproject | xerteonlinetoolkits | 3.15.0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload
exploit/multi/http/xerte_unauthenticated_mediaupload
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://github.com/bootstrapbool/xerteonlinetoolkits-rce technical-description exploit
- https://xerte.org.uk/xertetoolkits_3.15_ChangeLog.html release-notes
- https://xerte.org.uk/index.php/en/downloads-1/category/3-xerte-online-toolkits product permissions-required
- https://github.com/thexerteproject/xerteonlinetoolkits/issues/1527 issue-tracking
- https://github.com/thexerteproject/xerteonlinetoolkits/commit/f063e942b4a9bf77a06829e844c2c70316bc45e8 patch
- https://www.vulncheck.com/advisories/xerte-online-toolkits-path-disclosure-via-setup third-party-advisory