Flir Local File Inclusion Scanner
Detects 'Local File Inclusion (LFI)' vulnerability in Flir.
Short Info
Level
High
Single Scan
Single Scan
Can be used by
Asset Owner
Estimated Time
10 seconds
Time Interval
17 days 11 hours
Scan only one
URL
Toolbox
-
Flir is widely used in various industries for thermal imaging and surveillance purposes. It is employed by security professionals, maintenance teams, and environmental scientists to detect heat anomalies and gather crucial data. By providing real-time thermal imaging, Flir devices aid in critical decision-making processes. These devices are versatile, supporting applications in industry, defense, and research. They provide users with the ability to visualize otherwise invisible processes and conditions. Flir's software integrates seamlessly with their hardware devices, making them essential tools in various fields.
Local File Inclusion (LFI) is a web vulnerability that allows an attacker to include files on a server through the web browser. This vulnerability arises when the web application includes files based on user input without proper validation. Upon exploitation, unauthorized users could access sensitive files like configuration files. Such files may contain critical information that could be used to escalate an attack. LFI can also lead to disclosure of system files, posing a significant risk to the affected system.
The Flir vulnerability is exploited through a specific endpoint that is susceptible to LFI. The endpoint '/download.php' is designed to serve files based on user query parameters. During testing, the 'file' parameter was found to be vulnerable to manipulation. An attacker can manipulate this parameter by injecting paths to sensitive files. The system improperly processes the request without necessary security checks, leading to local file inclusion.
If exploited, attackers can access sensitive local files. This flaw may expose sensitive configurations, credential files, or other critical files to unauthorized users. Attackers may use this information for further malicious activities, such as privilege escalation. The vulnerability undermines the confidentiality and integrity of the data and the system's security posture. Resolving this issue is crucial to prevent unauthorized access and data leakage.
REFERENCES
