Description
D-LINK DIR-845L <=v1.01KRb03 存在通过 bsc_sms_inbox.php 进行信息泄露的漏洞。允许通过bsc_sms_inbox.php 文件泄露信息。该漏洞是由于对 include() 函数处理不当而引起的，可以通过操纵 $file变量来利用该漏洞。这使得攻击者可以包含任意 PHP 脚本并可能检索敏感信息，例如路由器的用户名和密码。
D-LINK DIR-845L接口bsc_sms_inbox.php存在信息泄露漏洞(CVE-2024-33113)
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-33113
https://github.com/FaLLenSKiLL1/CVE-2024-33113
https://blog.csdn.net/m0_50125527/article/details/147471081
https://www.ddpoc.com/DVB-2025-9091.html
https://cve.imfht.com/poc_detail/318f356e6f37260fc2e3da2788305b28fb7df222
https://cn-sec.com/archives/2882161.html
https://pentest-tools.com/vulnerabilities-exploits/d-link-dir-845l-bsc-sms-inboxphp-file-information-disclosure_22933