CVE-2014-6308 PoC — OSClass 目录遍历漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-6308.yaml

Associated Vulnerability

Title:OSClass 目录遍历漏洞 (CVE-2014-6308)
Description:Osclass是一套基于PHP和MySQL的用于创建和管理分类广告网站的开源内容管理系统（CMS）。 OSClass 3.4.2之前版本中存在目录遍历漏洞，该漏洞源于程序执行render操作时，oc-admin/index.php脚本没有充分过滤‘file’参数。远程攻击者可借助目录遍历字符‘..’利用该漏洞读取任意文件。

Description

A directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter in a render action to oc-admin/index.php.

File Snapshot


 id: CVE-2014-6308

info:
  name: Osclass Security Advisory 3.4.1 - Local File Inclusion
  author: da

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!