id: solar-log-authbypass info: name: Solar-Log 500 2.8.2 - Incorrect Access Control author: geeknik severity: high description: Solar-Log 500 2.8.2 is susceptible to incorrect access control because the web administration server for Solar-Log 500 all versions prior to 2.8.2 Build 52 does not require authentication, which allows arbitrary remote attackers gain administrative privileges by connecting to the server. reference: - https://www.exploit-db.com/exploits/49986 classification: cwe-id: CWE-284 tags: solarlog,auth-bypass requests: - method: GET path: - "{{BaseURL}}/lan.html" matchers-condition: and matchers: - type: status status: - 200 - type: word part: header words: - "IPC@CHIP" - type: word part: body words: - " Solare Datensysteme GmbH" - "mailto:info@solar-log.com" condition: and # Enhanced by mp on 2022/04/12