Microsoft SharePoint Server CreateChildControls Server Side Include Vulnerability Exploit (CVE-2020-16952)

A server-side include in Microsoft SharePoint via CreateChildControls in DataFormWebPart class allows an authenticated user to leak the web.config file and forge a malicious ViewState with the extracted validation key.



The user credentials requires user with page creation privileges, a standard permission.
CVE Link
CVE-2020-16952
Exploit Platform
Windows
Exploit Type
Exploits
OS Command Injection
Known Vulnerabilities
Product Name
Impact