CVE-2006-3392 PoC — Webmin/Usermin未明信息泄露漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2006/CVE-2006-3392.yaml

Associated Vulnerability

Title:Webmin/Usermin未明信息泄露漏洞 (CVE-2006-3392)
Description:Webmin 1.290之前版本和Usermin 1.220之前版本在解码HTML之前调用simplify_path 函数，可以使远程攻击者读取任意文件，比如使用"..%01"序列，该序列可在从文件名中删除诸如"%01"等字节之前绕过"../" 序列的删除。注：此漏洞不同于CVE-2006-3274。

Description

Webmin before 1.290 and Usermin before 1.220 contain a path traversal caused by calling the simplify_path function before decoding HTML, letting remote attackers read arbitrary files, exploit requires sending crafted '..%01' sequences.

File Snapshot


 id: CVE-2006-3392

info:
  name: Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure
  auth

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!