Gfi Exinda Ai
Monthly
Argument injection in GFI Exinda AI before 7.6.5 allows any authenticated user - including those with the lowest-privilege Unprivileged account - to exfiltrate arbitrary files from the host system. The web_tools_cmd() function in the Tools Iperf Client feature concatenates user-supplied server and options parameters directly into an iperf command without sanitization, enabling injection of the iperf -F flag to redirect file contents to an attacker-controlled iperf server. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but exploitation is straightforward given knowledge of standard iperf flags.
Arbitrary root-level file deletion in GFI Exinda AI before 7.6.5 is possible through a path traversal flaw in the diagnostic file deletion handler. The `unlink_or_email_file()` function appends user-controlled parameter values (prefixed `v_file_row_`) directly to a base directory path without sanitizing for `../` sequences, allowing any file on the filesystem to be targeted. Exploitation requires authenticated Admin-level access via the network management interface; no public exploit code or CISA KEV listing exists at time of analysis.
Path traversal in GFI Exinda AI before 7.6.5 allows an authenticated administrator to read arbitrary files from the underlying system as root. The vulnerability resides in the wcf_handle_download() function within the system maintenance configuration download handler, which fails to sanitize directory traversal sequences embedded in parameters prefixed with v_del_ before appending them to the base configuration directory path. No public exploit code or active exploitation has been identified at the time of analysis, and exploitation is constrained to Admin-privileged accounts.
Argument injection in GFI Exinda AI before 7.6.5 allows any authenticated user - including those with the lowest-privilege Unprivileged account - to exfiltrate arbitrary files from the host system. The web_tools_cmd() function in the Tools Iperf Client feature concatenates user-supplied server and options parameters directly into an iperf command without sanitization, enabling injection of the iperf -F flag to redirect file contents to an attacker-controlled iperf server. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but exploitation is straightforward given knowledge of standard iperf flags.
Arbitrary root-level file deletion in GFI Exinda AI before 7.6.5 is possible through a path traversal flaw in the diagnostic file deletion handler. The `unlink_or_email_file()` function appends user-controlled parameter values (prefixed `v_file_row_`) directly to a base directory path without sanitizing for `../` sequences, allowing any file on the filesystem to be targeted. Exploitation requires authenticated Admin-level access via the network management interface; no public exploit code or CISA KEV listing exists at time of analysis.
Path traversal in GFI Exinda AI before 7.6.5 allows an authenticated administrator to read arbitrary files from the underlying system as root. The vulnerability resides in the wcf_handle_download() function within the system maintenance configuration download handler, which fails to sanitize directory traversal sequences embedded in parameters prefixed with v_del_ before appending them to the base configuration directory path. No public exploit code or active exploitation has been identified at the time of analysis, and exploitation is constrained to Admin-privileged accounts.