CNVD-2019-01348: Xiuno BBS CNVD-2019-01348

日期: 2025-08-01 | 影响软件: Xiuno BBS | POC: 已公开

漏洞描述

Xiuno BBS系统存在系统重装漏洞。该漏洞源于系统安装完毕后未对安装目录进行任何防护或过滤，攻击者可直接通过安装页面重装系统。Xiuno BBS 4.0.4

PoC代码[已公开]

id: CNVD-2019-01348

info:
  name: Xiuno BBS CNVD-2019-01348
  author: princechaddha
  severity: high
  description: The Xiuno BBS system has a system reinstallation vulnerability. The vulnerability stems from the failure to protect or filter the installation directory after the system is installed. Attackers can directly reinstall the system through the installation page.
  remediation: Upgrade to the latest version of Xiuno BBS or switch to a supported product.
  reference:
    - https://www.cnvd.org.cn/flaw/show/CNVD-2019-01348
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cwe-id: CWE-284
  metadata:
    max-request: 1
  tags: cnvd2019,cnvd,xiuno,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/install/"

    headers:
      Accept-Encoding: deflate

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "/view/js/xiuno.js"
          - "Choose Language (选择语言)"
        condition: and
# digest: 490a00463044022022c8e80fb2b25c167a789ed337cda5c6d032c377a0bdaa8c4888cf80ba9e8ce40220305dd8af0e292cedfaf9b85cd51ecd7a54ad8ea20b488cab6f6e88b4e04a2414:922c64590222798bb761d5b6d8e72950
来源: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cnvd/2019/CNVD-2019-01348.yaml

相关漏洞推荐