CVE-2022-31793 PoC — muhttpd 路径遍历漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2022/CVE-2022-31793.yaml

Associated Vulnerability

Title: muhttpd 路径遍历漏洞 (CVE-2022-31793)
Description:do_request in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired path on the filesystem. This occurs because the code skips over the first character when serving files. Arris NVG443, NVG599, NVG589, and NVG510 devices and Arris-derived BGW210 and BGW320 devices are affected.

Description

muhttpd 1.1.5 and before are vulnerable to unauthenticated local file inclusion. The vulnerability allows retrieval of files from the file system.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →