CVE-2017-12637 PoC — SAP NetWeaver Application Server Java 路径遍历漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12637.yaml

Associated Vulnerability

Title:SAP NetWeaver Application Server Java 路径遍历漏洞 (CVE-2017-12637)
Description:SAP NetWeaver是德国思爱普（SAP）公司的一套面向服务的集成化应用平台，该平台可为SAP应用提供开发和运行环境。SAP NetWeaver Application Server（AS）Java是一款运行于NetWeaver中且基于Java编程语言的应用服务器。 SAP NetWeaver AS Java 7.5版本中的scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS目录存在目录遍历漏洞。远程攻击者可借助特制的查询字符串利用该漏洞读取任意文件

Description

SAP NetWeaver Application Server Java 7.5 is susceptible to local file inclusion in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS. This can allow remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.

File Snapshot


 id: CVE-2017-12637

info:
  name: SAP NetWeaver Application Server Java 7.5 - Local File Inclusion
 

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!