CVE-2017-9833

/cgi-bin/wapopen in BOA Webserver 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read files with root privileges.

Date published : 2017-06-23

https://www.exploit-db.com/exploits/42290/

https://pastebin.com/raw/rt7LJvyF