nuclei-templates/http/misconfiguration/default-spx-key.yaml

id: default-spx-key

info:
  name: SPX PHP Profiler - Default Key
  author: vagnerd
  severity: high
  description: |
    SPX PHP profiler default spx key were discovered.
  remediation: |
    - https://github.com/NoiseByNorthwest/php-spx#security-concern
  reference:
    - https://github.com/NoiseByNorthwest/php-spx
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
    cvss-score: 8.3
    cwe-id: CWE-522
  metadata:
    verified: true
    max-request: 11
  tags: spx-php,debug,misconfig,spx

http:
  - method: GET
    path:
      - "{{BaseURL}}/?SPX_KEY={{api_key}}&SPX_UI_URI=/"

    attack: batteringram
    payloads:
      api_key:
        - dev
        - devel
        - stg
        - stag
        - staging
        - prd
        - prod
        - production
        - test
        - testing
        - spx
    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<title>SPX Control Panel</title>'
          - 'SPX_ENABLED'
          - "Configuration"
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200

# digest: 4a0a00473045022100c0572b3481460947441769560ba23e41fa23a500c9905ce4585cca52e3bd97cc02203322aafc293dff0bfb9f0a7933d49df6b9f26dd9c1996198e14f90f26049099f:922c64590222798bb761d5b6d8e72950