Is being able to put some form of xenforo syntax inside a template or widget and be able to read /etc/passwd or any other file the web server user has access to such as config.php considered a vulnerability? I might have found an exploit if so you can do this on the latest version all the way back to at least v2.1.4 might even go before that. Also considered an ssrf since you can read files behind firewalls etc, and do requests to the outside to get the server origin ip for example (to...
Read more
Continue reading...
Read more
Continue reading...