id: 3com-nj2000-default-login

info:
  name: 3COM NJ2000 - Default Login
  author: daffainfo
  severity: high
  description: 3COM NJ2000 contains a default login vulnerability. Default admin login password of 'password' was found. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations.
  reference:
    - https://www.manualslib.com/manual/204158/3com-Intellijack-Nj2000.html?page=12
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
    cvss-score: 8.3
    cwe-id: CWE-522
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.title:"ManageEngine Password"
    fofa-query: body="NJ2000"
  tags: default-login,3com,nj2000

http:
  - raw:
      - |
        POST /login.html HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        password=password

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<title>3Com Corporation Web Interface</title>'
          - '<frame name="mainFrame" src="blank.html">'
        condition: and

      - type: status
        status:
          - 200

# digest: 4a0a0047304502200a88cf4bb5846600903ae242322fcde2a7ef5ebd239118bbe3ebfe397f56e699022100f9249927da9c4096018d82c404d535e1dcaabbe0f277ba128f0513316c44aefb:922c64590222798bb761d5b6d8e72950
