Skip to content
Nuclei Templates

EyouCms v1.6.3 - Information Disclosure

ID: CVE-2023-37645

Severity: medium

Author: pussycat0x

Tags: cve,cve2023,info-leak,eyoucms

Description

Section titled “Description”

EyouCms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custom_model_path/recruit.filelist.txt.

YAML Source

Section titled “YAML Source”
id: CVE-2023-37645


info:
  name: EyouCms v1.6.3 - Information Disclosure
  author: pussycat0x
  severity: medium
  description: |
    EyouCms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custom_model_path/recruit.filelist.txt.
  impact: |
    An attacker can exploit this vulnerability to gain sensitive information.
  remediation: |
    Upgrade eYouCMS to a patched version to mitigate CVE-2023-37645.
  reference:
    - https://github.com/weng-xianhu/eyoucms/issues/50
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2023-37645
    cwe-id: CWE-668
    epss-score: 0.00046
    epss-percentile: 0.16551
    cpe: cpe:2.3:a:eyoucms:eyoucms:1.6.3:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: eyoucms
    product: eyoucms
    fofa-query:
      - icon_hash="-614262549"
      - title="eyoucms"
  tags: cve,cve2023,info-leak,eyoucms


http:
  - method: GET
    path:
      - "{{BaseURL}}/data/model/custom_model_path/recruit.filelist.txt"


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "application/admin/"
          - "template/pc/"
        condition: and


      - type: status
        status:
          - 200
# digest: 490a00463044022003adf6b737c8c1049c2ac297dad25b0a963bc6c2fc8b6946b9dac2f0094082bb02200d4ed2c603eb9397f8335f9d5f3e1ff64b67d138f2cded57c4601d9be3e4897a:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-37645.yaml"

View on Github