跳转到帖子

recommended_posts

发布于
  • Members

Froxlor Log Path RCE

Disclosed
01/29/2023
Created
02/22/2023

Description

Froxlor v2.0.7 and below suffer from a bug that allows authenticated users to change the application logs path to any directory on the OS level which the user www-data can write without restrictions from the backend which leads to writing a malicious Twig template that the application will render. That will lead to achieving a remote command execution under the user www-data.

Author(s)

  • Askar
  • jheysel-r7

Platform

Linux

Architectures

cmd

Development

  • Source Code
  • History
  • 查看数 694
  • 已创建
  • 最后回复

参与讨论

你可立刻发布并稍后注册。 如果你有帐户,立刻登录发布帖子。

游客
回帖…