Jun 26, 2026, 07:12 AM
https://bf.st/attachments/2422/
Attacker: Nemoris_Hacking
Target website: umaee.edu.mx
Details regarding the incident:
The error displayed indicates a Controller Loading Failure condition within the Phalcon framework, specifically in the Frontend module. Although it appears to be a superficial technical error, it may mask critical vulnerabilities related to:
Path Traversal / Directory Traversal
Controller Injection
Sensitive Information Exposure
Potential Remote Code Execution (RCE) in specific scenarios
Fatal error: Uncaught Phalcon\Mvc\Dispatcher\Exception:
Modules\Frontend\Controllers\DashController handler class cannot be loaded
in /var/www/html/ACTIVES/AT_ADMIN_UMAEE/public/index.php:720
/var/www/html/ACTIVES/AT_ADMIN_UMAEE/ Full file system path Critical information leak - exposes the complete file structure
Controller Injection (CWE-94)
If the controller name originates from user input
curl -X GET "http://target.com/%2e%2e%2f%2e%2e%2f%2e%...c%2fpasswd"
Data Link : https://gofile.io/d/BZLctB
Attacker: Nemoris_Hacking
Target website: umaee.edu.mx
Details regarding the incident:
The error displayed indicates a Controller Loading Failure condition within the Phalcon framework, specifically in the Frontend module. Although it appears to be a superficial technical error, it may mask critical vulnerabilities related to:
Path Traversal / Directory Traversal
Controller Injection
Sensitive Information Exposure
Potential Remote Code Execution (RCE) in specific scenarios
Fatal error: Uncaught Phalcon\Mvc\Dispatcher\Exception:
Modules\Frontend\Controllers\DashController handler class cannot be loaded
in /var/www/html/ACTIVES/AT_ADMIN_UMAEE/public/index.php:720
/var/www/html/ACTIVES/AT_ADMIN_UMAEE/ Full file system path Critical information leak - exposes the complete file structure
Controller Injection (CWE-94)
If the controller name originates from user input
curl -X GET "http://target.com/%2e%2e%2f%2e%2e%2f%2e%...c%2fpasswd"
Data Link : https://gofile.io/d/BZLctB