Merge pull request #2265 from pussycat0x/master

zabbix-dashboards-access

misconfiguration/zabbix-dashboards-access.yaml

@@ -0,0 +1,26 @@
+id: zabbix-dashboards-access
+
+info:
+  name: zabbix-dashboards-access
+  author: pussycat0x
+  severity: medium
+  description: View dashboard with guest login.
+  reference: https://www.exploit-db.com/ghdb/5595
+  tags: zabbix,unauth
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/zabbix/zabbix.php?action=dashboard.list"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Create dashboard"
+          - "Zabbix SIA"
+        condition: and
+
+      - type: status
+        status:
+          - 200

vulnerabilities/wordpress/wp-upload-data.yaml

@@ -0,0 +1,29 @@
+id: wordpress-upload-data
+
+info:
+  name: wordpress-upload-data
+  author: pussycat0x
+  severity: medium
+  description: Searches for Passwords  in the wordpress uploads directory.
+  reference: https://www.exploit-db.com/ghdb/7040
+  tags: wordpress,listing
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/uploads/data.txt"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "admin:"
+
+      - type: word
+        part: header
+        words:
+          - "text/plain"
+
+      - type: status
+        status:
+          - 200