2021-09-17 14:04:21 +00:00
id : luftguitar-arbitrary-file-upload
info :
name : Luftguitar CMS Arbitrary File Upload
author : pikpikcu
severity : high
2021-10-19 10:03:41 +00:00
description : A vulnerability in Luftguitar CMS allows remote unauthenticated users to upload files to the remote service via the 'ftb.imagegallery.aspx' endpoint.
2022-04-22 10:38:41 +00:00
reference :
- https://www.exploit-db.com/exploits/14991
2023-04-28 08:11:21 +00:00
metadata :
max-request : 1
2023-10-14 11:27:55 +00:00
tags : luftguitar,edb
2021-09-17 14:04:21 +00:00
2023-04-27 04:28:59 +00:00
http :
2021-09-17 14:04:21 +00:00
- method : GET
path :
2021-09-18 09:02:13 +00:00
- "{{BaseURL}}/ftb.imagegallery.aspx"
2021-09-17 14:04:21 +00:00
matchers-condition : and
matchers :
- type : word
part : body
words :
2021-09-18 08:58:03 +00:00
- '<title>Insert Image</title>'
2021-09-18 06:44:32 +00:00
- '<title>Image Gallery</title>'
2021-09-18 08:58:03 +00:00
condition : or
2021-09-17 14:04:21 +00:00
- type : status
status :
- 200
2023-10-20 11:41:13 +00:00
# digest: 490a0046304402207418697a1264a13c3e5b0967b7520ddef1cd093cdceefb070dece39849c97eec02203347f0d3c171051aa3fb78c8b3e1100318951b20e8c0bc2293f329a4a3c1bfde:922c64590222798bb761d5b6d8e72950
