CVE-2017-15363 PoC — TYPO3 restler extension Luracast Restler 路径遍历漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-15363.yaml

Associated Vulnerability

Title:TYPO3 restler extension Luracast Restler 路径遍历漏洞 (CVE-2017-15363)
Description:TYPO3是瑞士TYPO3协会维护的一套免费开源的内容管理系统(框架)(CMS/CMF)。restler extension是其中的一个HTTP客户端库扩展。Luracast Restler是其中的一个多格式Web API服务器。 TYPO3中的restler extension 1.7.1之前的版本中的Luracast Restler 3.0.0及之前的版本中的public/examples/resources/getsource.php文件存在目录遍历漏洞。远程攻击者可借助‘file’参数利用该漏洞读

Description

Luracast Restler 3.0.1 via TYPO3 Restler 1.7.1 is susceptible to local file inclusion in public/examples/resources/getsource.php. This could allow remote attackers to read arbitrary files via the file parameter.

File Snapshot


 id: CVE-2017-15363

info:
  name: Luracast Restler 3.0.1 via TYPO3 Restler 1.7.1 - Local File Inclus

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!