# N/A
## 漏洞概述
Webmin 版本低于 1.290 和 Usermin 版本低于 1.220 在解码 HTML 之前调用了 `simplify_path` 函数，这允许远程攻击者读取任意文件。通过使用 `..%01` 序列可以绕过文件名中 `../` 序列的移除，然后移除诸如 `%01` 这样的字节。
## 影响版本
- Webmin < 1.290
- Usermin < 1.220
## 漏洞细节
该漏洞利用了在解码 HTML 之前对路径进行简化时存在的问题。攻击者可以通过在文件路径中插入 `..%01` 序列，绕过路径中 `../` 序列的移除，从而访问任意文件。
## 影响
此漏洞允许远程攻击者读取服务器上的任意文件，可能暴露敏感信息。
是否为 Web 类漏洞： 是
判断理由：
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure (Python3) | https://github.com/0xtz/CVE-2006-3392 | POC详情 |
| 2 | This small script helps to avoid using MetaSploit (msfconsole) during the Enterprise pentests and OSCP-like exams. Grep included function will help you to get only the important information. | https://github.com/IvanGlinkin/CVE-2006-3392 | POC详情 |
| 3 | It is a simple tool to exploit local file include . vulnerabilities | https://github.com/Adel-kaka-dz/CVE-2006-3392 | POC详情 |
| 4 | Python script to exploit webmin vulnerability cve-2006-3392 | https://github.com/gb21oc/ExploitWebmin | POC详情 |
| 5 | Webmin Local File Include (unauthenticated) | https://github.com/kernel-cyber/CVE-2006-3392 | POC详情 |
| 6 | Webmin < 1.290 / Usermin < 1.220 - Arbitrary file disclosure | https://github.com/g1vi/CVE-2006-3392 | POC详情 |
| 7 | None | https://github.com/MrEmpy/CVE-2006-3392 | POC详情 |
| 8 | None | https://github.com/brosck/CVE-2006-3392 | POC详情 |
| 9 | Webmin before 1.290 and Usermin before 1.220 contain a path traversal caused by calling the simplify_path function before decoding HTML, letting remote attackers read arbitrary files, exploit requires sending crafted '..%01' sequences. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2006/CVE-2006-3392.yaml | POC详情 |
暂无评论