Merge pull request #9533 from projectdiscovery/pussycat0x-patch-7
Create dlink-unauth-cgi-script.yamlpatch-1
commit
a51fc4633b
|
@ -0,0 +1,32 @@
|
|||
id: dlink-unauth-cgi-script
|
||||
|
||||
info:
|
||||
name: D-Link DNS Series CGI Script - Unauthenticated
|
||||
author: pussycat0x
|
||||
severity: low
|
||||
description: |
|
||||
A vulnerability has been identified in the D-Link DNS series network storage devices, allowing for the exposure of sensitive device information to unauthorized actors. This vulnerability is due to an unauthenticated access flaw in the info.cgi script, which can be exploited via a simple HTTP GET request, affecting over 920,000 devices on the Internet.
|
||||
reference:
|
||||
- https://github.com/netsecfish/info_cgi
|
||||
metadata:
|
||||
verified: true
|
||||
fofa-query: app="D_Link-DNS"
|
||||
tags: unauth,dlink,misconfig
|
||||
|
||||
http:
|
||||
- method: GET
|
||||
path:
|
||||
- "{{BaseURL}}/cgi-bin/info.cgi"
|
||||
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "Product="
|
||||
- "Version="
|
||||
- "Model="
|
||||
condition: and
|
||||
|
||||
- type: status
|
||||
status:
|
||||
- 200
|
Loading…
Reference in New Issue