Ac1d D4ddyApr 7, 2024
@campuscodi I looked at the PoC and have a few questions:
1. get_files() gets the files from the server without any cookies. I assume this is the path traversal. Is that right?
2. get_keys() uses an SQLi in the login to log in as admin (?) and then dumps the decryption keys. So is this a separate SQLi and a path traversal vulnerability used together to pwn the login page? Could you possibly get an RCE via SQli in the login page?
Show threadchebuyaApr 9, 2024

@ac1d_d4ddy @campuscodi
Hey I am the author of this exploit :3. The get_files() function is the pre-auth path traversal, yes

The SQLi is used to login to the web panel and collect the filesystem paths for decryption keys (they are shown in the web panel). Technically, these would be accessible if you could guess the filename since they are stored in the webroot, but bypassing them and collecting the filenames is possible so why not

Show threadAc1d D4ddy
@chebuya good find!
Apr 9, 2024 at 3:34amWeb