漏洞描述
/api/thumbnail端点中存在目录遍历漏洞，该漏洞是由于应用对fileName参数的值验证不当导致的。
LG LED Assistant thumbnail 目录遍历漏洞
PoC代码
暂无相关漏洞推荐
- POC CVE-2024-2862: LG LED Assistant - Unauthenticated Password Reset
- POC CVE-2024-2863: LG LED Assistant - Thumbnail Path Traversal File Upload
- POC CVE-2020-11732: Media Library Assistant < 2.82 - Unauthenticated Limited Local File Inclusion
- POC CVE-2023-27482: Home Assistant Supervisor - Authentication Bypass
- POC CVE-2023-4634: Media Library Assistant < 3.09 - Remote Code Execution/Local File Inclusion
- POC CVE-2024-7714: AI Assistant with ChatGPT by AYS <= 2.0.9 - Unauthenticated AJAX Calls
- POC weaver-sptmforportalthumbnail-lfi: OA E-Weaver SptmForPortalThumbnail - Arbitrary File Read
- 同望OA tooneAssistantAttachement.jsp 任意文件读取漏洞
- LG LED Assistant智能灯管助手 CVE-2023-4614 远程代码执行漏洞
- LG LED Assistant seamCorrectionFileCreate 目录遍历漏洞
- LG LED Assistant upload 目录遍历漏洞
- LG LED Assistant updateFile 目录遍历漏洞
- WordPress Media Library Assistant Plugin CVE-2023-4634 本地文件包含漏洞