CVE-2021-28377 PoC — ChronoEngine ChronoForms 路径遍历漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28377.yaml

Associated Vulnerability

Title: ChronoEngine ChronoForms 路径遍历漏洞 (CVE-2021-28377)
Description:ChronoForums 2.0.11 allows av Directory Traversal to read arbitrary files.

Description

Joomla! ChronoForums 2.0.11 avatar function is vulnerable to local file inclusion through unauthenticated path traversal attacks. This enables an attacker to read arbitrary files, for example the Joomla! configuration file which contains credentials.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →