Description
TVT数码科技 NVMS-1000 系统存在任意文件读取漏洞，攻击者可通过向包含路径遍历字符（../../）的路径发送POST请求，读取服务器上的敏感文件，如系统配置文件和凭证信息。
TVT 数码科技 NVMS-1000 / 文件读取漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2019-20085
https://www.exploit-db.com/exploits/48311
https://peiqi.wgpsec.org/wiki/iot/TVT%E6%95%B0%E7%A0%81%E7%A7%91%E6%8A%80/TVT%E6%95%B0%E7%A0%81%E7%A7%91%E6%8A%80%20NVMS-1000%20%E8%B7%AF%E5%BE%84%E9%81%8D%E5%8E%86%E6%BC%8F%E6%B4%9E%20CVE-2019-20085.html
https://stack.chaitin.com/vuldb/detail/61e39093-7f83-4259-828e-e738709105ba
https://github.com/zeroChen00/exp-poc/blob/main/TVT%E6%95%B0%E7%A0%81%E7%A7%91%E6%8A%80NVMS-1000%E8%B7%AF%E5%BE%84%E9%81%8D%E5%8E%86%E6%BC%8F%E6%B4%9E(CVE-2019-20085).md
https://blog.csdn.net/qq_35938621/article/details/124285722
https://www.rapid7.com/db/modules/auxiliary/scanner/http/tvt_nvms_traversal/
https://avd.aliyun.com/detail?id=AVD-2019-20085