id: saltbo-zpan-installer

info:
  name: Saltbo/zpan Installer - Exposure
  author: ritikchaddha
  severity: high
  description: |
    Detects the exposure of the Saltbo/zpan installer page, which could allow unauthorized setup or reinstallation of the application.
  reference:
    - https://github.com/saltbo/zpan
  metadata:
    verified: true
    max-request: 2
    product: zpan
    vendor: saltbo
    fofa-query: body="zpan"
  tags: saltbo,zpan,installer,exposure,misconfig

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/system/options/core.email"
      - "{{BaseURL}}/install"

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - "<title>ZPan"

      - type: word
        part: body_1
        words:
          - "system is not initialized"
# digest: 4a0a00473045022100edbc747a12adbc8f959092b7437558c103b4932be9795a26f934b0a09c324a3402206f65d3fda37683cf5467294222a012a7b8d11345b56e2d9527fe0b4f71a99658:922c64590222798bb761d5b6d8e72950