id: default-spx-key

info:
  name: SPX PHP Profiler - Default Key
  author: vagnerd
  severity: high
  description: |
    SPX PHP profiler default spx key were discovered.
  reference:
    - https://github.com/NoiseByNorthwest/php-spx
  remediation: |
    - https://github.com/NoiseByNorthwest/php-spx#security-concern
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
    cvss-score: 8.3
    cwe-id: CWE-522
  metadata:
    max-request: 11
    verified: "true"
  tags: spx-php,debug,misconfig,spx

http:
  - method: GET
    path:
      - "{{BaseURL}}/?SPX_KEY={{api_key}}&SPX_UI_URI=/"

    attack: batteringram
    payloads:
      api_key:
        - dev
        - devel
        - stg
        - stag
        - staging
        - prd
        - prod
        - production
        - test
        - testing
        - spx

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<title>SPX Control Panel</title>'
          - 'SPX_ENABLED'
          - "Configuration"
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200