Added CGI script environment variable (#3498)
parent
491d46335f
commit
5c8ccbd1e5
|
@ -0,0 +1,29 @@
|
|||
id: cgi-printenv
|
||||
|
||||
info:
|
||||
author: emadshanab
|
||||
name: CGI script environment variable
|
||||
severity: medium
|
||||
description: A test CGI (Common Gateway Interface) script was found on this server. The response page returned by this CGI script is leaking a list of server environment variables.
|
||||
reference: https://www.acunetix.com/vulnerabilities/web/test-cgi-script-leaking-environment-variables/
|
||||
tags: exposure,generic,cgi
|
||||
|
||||
requests:
|
||||
- method: GET
|
||||
path:
|
||||
- "{{BaseURL}}/cgi-bin/printenv.pl"
|
||||
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- 'MYSQL_HOME'
|
||||
- 'OPENSSL_CONF'
|
||||
- 'REMOTE_ADDR'
|
||||
- 'SERVER_ADMIN'
|
||||
- 'Environment Variables:'
|
||||
condition: or
|
||||
|
||||
- type: status
|
||||
status:
|
||||
- 200
|
Loading…
Reference in New Issue