| Título | Eleveo Quality Management 9.7.0 Arbitrary File Read and Deletion |
|---|
| Descripción | A Local File Disclosure and Arbitrary File Deletion vulnerability exists in the questionnaire audio upload functionality of Eleveo Quality Management 9.7.0, which is implemented via three endpoints. The first endpoint accepts file content and returns a temporary local file path. The second endpoint accepts this file path to associate it with a questionnaire and returns an ID. The third endpoint retrieves the uploaded file using the ID.
Authenticated users can modify the file path in the second endpoint to reference arbitrary local files, such as /etc/passwd, /etc/shadow, or /proc/self/environ. The backend does not properly validate or restrict the file path, allowing disclosure of sensitive system files, environment variables, credentials, and application source code. Additionally, certain files, such as Scorecard.jsp, can be deleted or moved during processing, which may lead to complete denial of service.
Impact
• Disclosure of sensitive system files, environment variables, and credentials.
• Arbitrary deletion or movement of critical system files, potentially leading to complete denial of service.
• Unauthorized access to application source code and configuration.
PoC
Comprehensive reproduction steps, including supporting screenshots, are available via the shared private link. Public disclosure will occur on GitHub after the responsible disclosure period of approximately 90 days has elapsed.
Note
Contact with the vendor was initiated on April 5, and no response has been received as of the submission date. The provided PoC is accessible via a restricted link and is intended solely for review purposes by anyone possessing the link. I plan to reserve a CVE early, with public disclosure scheduled after 90 days from the initial contact date, at which point the advisory will be published on my GitHub repository. The information shared here is provided exclusively to the VulnDB team to ensure awareness and understanding of the vulnerability details. |
|---|
| Fuente | ⚠️ https://drive.google.com/file/d/1n6_L39uJ9mMteDwx4Z2XVnwsAZTbnf9s/view?usp=sharing |
|---|
| Usuario | omarelshopky (UID 85487) |
|---|
| Sumisión | 2026-07-18 14:32 (hace 2 meses) |
|---|
| Moderación | 2026-09-28 10:11 (2 months later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 410994 [Eleveo Quality Management 9.7.0 Questionnaire Audio Upload Scorecard.jsp recorrido de directorios] |
|---|
| Puntos | 20 |
|---|