daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/http/vulnerabilities/other/qihang-media-disclosure.yaml

35 lines
1.2 KiB
YAML
Raw Permalink Normal View History

Update and rename qihang-media-web-credentials-disclosure.yaml to qihang-media-disclosure.yaml
2021-10-01 10:56:25 +00:00
id: qihang-media-disclosure
Create qihang-media-web-credentials-disclosure.yaml The application suffers from clear-text credentials disclosure vulnerability that allows an unauthenticated attacker to issue a request to an unprotected directory that hosts an XML file /xml/User/User.xml and obtain administrative login information that allows for a successful authentication bypass attack. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-10-01 06:42:48 +00:00
info:
Enhancement: vulnerabilities/other/qihang-media-disclosure.yaml by mp
2022-05-30 16:17:42 +00:00
name: QiHang Media Web Digital Signage 3.0.9 - Cleartext Credentials Disclosure
Create qihang-media-web-credentials-disclosure.yaml The application suffers from clear-text credentials disclosure vulnerability that allows an unauthenticated attacker to issue a request to an unprotected directory that hosts an XML file /xml/User/User.xml and obtain administrative login information that allows for a successful authentication bypass attack. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-10-01 06:42:48 +00:00
author: gy741
Enhancement: vulnerabilities/other/qihang-media-disclosure.yaml by mp
2022-05-30 16:17:42 +00:00
severity: high
Update qihang-media-disclosure.yaml
2022-05-31 09:12:37 +00:00
description: |
QiHang Media Web Digital Signage 3.0.9 suffers from a clear-text credentials disclosure vulnerability that allows an unauthenticated attacker to issue a request to an unprotected directory that hosts an XML file /xml/User/User.xml and obtain administrative login information that allows for a successful authentication bypass attack.
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
reference:
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5579.php
Enhancement: vulnerabilities/other/qihang-media-disclosure.yaml by mp
2022-05-30 16:17:42 +00:00
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
cvss-score: 8.3
cwe-id: CWE-522
Added max request counter of each template
2023-04-28 08:11:21 +00:00
metadata:
max-request: 1
templateman update
2023-10-14 11:27:55 +00:00
tags: qihang,exposure
Create qihang-media-web-credentials-disclosure.yaml The application suffers from clear-text credentials disclosure vulnerability that allows an unauthenticated attacker to issue a request to an unprotected directory that hosts an XML file /xml/User/User.xml and obtain administrative login information that allows for a successful authentication bypass attack. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-10-01 06:42:48 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
2023-04-27 04:28:59 +00:00
http:
Create qihang-media-web-credentials-disclosure.yaml The application suffers from clear-text credentials disclosure vulnerability that allows an unauthenticated attacker to issue a request to an unprotected directory that hosts an XML file /xml/User/User.xml and obtain administrative login information that allows for a successful authentication bypass attack. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-10-01 06:42:48 +00:00
- method: GET
path:
- "{{BaseURL}}/xml/User/User.xml"
matchers:
- type: word
Update qihang-media-disclosure.yaml
2022-05-31 09:12:37 +00:00
part: body
Create qihang-media-web-credentials-disclosure.yaml The application suffers from clear-text credentials disclosure vulnerability that allows an unauthenticated attacker to issue a request to an unprotected directory that hosts an XML file /xml/User/User.xml and obtain administrative login information that allows for a successful authentication bypass attack. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-10-01 06:42:48 +00:00
words:
Update and rename qihang-media-web-credentials-disclosure.yaml to qihang-media-disclosure.yaml
2021-10-01 10:56:25 +00:00
- "<?xml version"
- "<Users>"
- "account="
- "password="
Create qihang-media-web-credentials-disclosure.yaml The application suffers from clear-text credentials disclosure vulnerability that allows an unauthenticated attacker to issue a request to an unprotected directory that hosts an XML file /xml/User/User.xml and obtain administrative login information that allows for a successful authentication bypass attack. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-10-01 06:42:48 +00:00
condition: and
TemplateMan Update [Fri Oct 20 11:41:12 UTC 2023] :robot:
2023-10-20 11:41:13 +00:00
# digest: 4a0a00473045022100b0ccc2410095cc0b8643fecc56332837abe16e738090fb425ade88ff74dc8ee202202fb2a4c5e13026904c35c4e5b1714a655b8b1d0a2836099f26d0923adcbac7cc:922c64590222798bb761d5b6d8e72950