id: lean-value-listing

info:
  name: LVS Lean Value Management System Business - Directory Listing
  author: pussycat0x
  severity: low
  description: |
    Multiple systems of Hangzhou Jila Technology Co., Ltd. have been found to have directory traversal vulnerabilities. These vulnerabilities arise from the inadequate access controls implemented in the /Business/ directory. Malicious actors can potentially leverage these vulnerabilities to illicitly access sensitive information.
  reference:
    - https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E5%90%89%E6%8B%89%E7%A7%91%E6%8A%80%20LVS%E7%B2%BE%E7%9B%8A%E4%BB%B7%E5%80%BC%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%20Business%20%E7%9B%AE%E5%BD%95%E9%81%8D%E5%8E%86%E6%BC%8F%E6%B4%9E.md
  metadata:
    verified: true
    max-request: 1
    fofa-query: "Supperd By 吉拉科技"
  tags: lean-value,misconfig,listing

http:
  - method: GET
    path:
      - "{{BaseURL}}/Business/"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '/Business/'
          - 'AgencytaskList.aspx'
        condition: and

      - type: status
        status:
          - 200

# digest: 4a0a00473045022064d2b1143fb654e389531f791545b97c7606c3cb4a4645e567da29a47b1c147e02210098ceb4c58af5ffca7ea4f5ad95640760a425d26a25d21955b20fda66ce9f68fc:922c64590222798bb761d5b6d8e72950