by Kastro
Paper/Archive/CVE-2024-1600

CVE-2024-1600

parisneo parisneo/lollms-webui — Local File Inclusion in parisneo/lollms-webui

EPSS 33%public exploitCVSS 9.3
critical.is priorityof 100
58
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 98.3.983 × 2019.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A Local File Inclusion (LFI) vulnerability exists in the parisneo/lollms-webui application, specifically within the `/personalities` route. An attacker can exploit this vulnerability by crafting a URL that includes directory traversal sequences (`../../`) followed by the desired system file path, URL encoded. Successful exploitation allows the attacker to read any file on the filesystem accessible by the web server. This issue arises due to improper control of filename for include/require statement in the application.

Affected

ProductAffectedFixed inSource
parisneo/lollms-webuiunspecified – < 9.59.5CNA
lollms-webui< 9.59.5CISA-ADP

Scores by source

@huntr_ai (CNA)9.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refhuntr.com/bounties/29ec621a-bd69-4225-ab0f-5bb8a1d10c67refgithub.com/parisneo/lollms-webui/commit/49b0332e98d42dd5204dda53dee410b160106265