GeoVision GeoWebServer Path Traversal Vulnerability Leading to Local File Inclusion, Cross-Site Scripting, and Remote Code Execution

A vulnerability in GeoVision GeoWebServer versions through 5.3.3 allows for local file inclusion (LFI), cross-site scripting (XSS), and remote code execution (RCE) due to inadequate input sanitization. Exploitation can occur via the WebStrings.srf endpoint by manipulating path traversal and injection parameters, enabling access to system files and execution of malicious scripts.

Impact

Exploitation of this vulnerability can lead to unauthorized access to sensitive system files, injection of malicious scripts that could be executed in the context of the user, and execution of arbitrary code on the server.

Reproduction

The vulnerability can be reproduced by sending a request to the WebStrings.srf endpoint with crafted path traversal sequences that bypass directory restrictions. This can be done using either GET or POST methods. The injected HTML or script can exploit the XSS vulnerability by, for example, stealing session cookies.