Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2019-18371

Description

An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. There is a directory traversal vulnerability to read arbitrary files via a misconfigured NGINX alias, as demonstrated by api-third-party/download/extdisks../etc/config/account. With this vulnerability, the attacker can bypass authentication.

POC

Reference

- https://github.com/UltramanGaia/Xiaomi_Mi_WiFi_R3G_Vulnerability_POC/blob/master/arbitrary_file_read_vulnerability.py

Github

- https://github.com/0day404/vulnerability-poc

- https://github.com/0xT11/CVE-POC

- https://github.com/20142995/Goby

- https://github.com/20142995/nuclei-templates

- https://github.com/20142995/sectool

- https://github.com/ARPSyndicate/cvemon

- https://github.com/ARPSyndicate/kenzer-templates

- https://github.com/AjayMT6/UltramanGaia

- https://github.com/ArrestX/--POC

- https://github.com/CnHack3r/Penetration_PoC

- https://github.com/EchoGin404/-

- https://github.com/EchoGin404/gongkaishouji

- https://github.com/KayCHENvip/vulnerability-poc

- https://github.com/Miraitowa70/POC-Notes

- https://github.com/Mr-xn/Penetration_Testing_POC

- https://github.com/SexyBeast233/SecBooks

- https://github.com/Threekiii/Awesome-POC

- https://github.com/Tyro-Shan/gongkaishouji

- https://github.com/UltramanGaia/POC-EXP

- https://github.com/UltramanGaia/Xiaomi_Mi_WiFi_R3G_Vulnerability_POC

- https://github.com/XiaomingX/awesome-poc-for-red-team

- https://github.com/YIXINSHUWU/Penetration_Testing_POC

- https://github.com/ZTK-009/Penetration_PoC

- https://github.com/d4n-sec/d4n-sec.github.io

- https://github.com/developer3000S/PoC-in-GitHub

- https://github.com/f1tao/awesome-iot-security-resource

- https://github.com/hasee2018/Penetration_Testing_POC

- https://github.com/hectorgie/PoC-in-GitHub

- https://github.com/huike007/penetration_poc

- https://github.com/huike007/poc

- https://github.com/huisetiankong478/penetration_poc

- https://github.com/huisetiankong478/poc

- https://github.com/lions2012/Penetration_Testing_POC

- https://github.com/password520/Penetration_PoC

- https://github.com/pentration/gongkaishouji

- https://github.com/winterwolf32/CVE-S---Penetration_Testing_POC-

- https://github.com/xuetusummer/Penetration_Testing_POC

- https://github.com/yedada-wei/-

- https://github.com/yedada-wei/gongkaishouji