diff --git a/http/vulnerabilities/other/crocus-lfi.yaml b/http/vulnerabilities/other/crocus-lfi.yaml index a9df36dcdf..21babae9c2 100644 --- a/http/vulnerabilities/other/crocus-lfi.yaml +++ b/http/vulnerabilities/other/crocus-lfi.yaml @@ -5,7 +5,7 @@ info: author: pussycat0x severity: high description: | - This template detects the ability to download the win.ini file from the Windows directory by exploiting a file download vulnerability. + There is an arbitrary file reading vulnerability in the Service.do interface of Ruiming Technology's Crocus system. An unauthenticated remote attacker can use this vulnerability to read important system files (such as database configuration files, system configuration files), database configuration files, etc. This leaves the website in an extremely unsafe state. reference: - https://github.com/wy876/POC/blob/main/%E9%94%90%E6%98%8E%E6%8A%80%E6%9C%AFCrocus%E7%B3%BB%E7%BB%9FService.do%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md metadata: