Files
nuclei-templates/http/vulnerabilities/avtech/avtech-dvr-ssrf.yaml
2024-12-01 13:57:55 +00:00

39 lines
1.1 KiB
YAML

id: avtech-dvr-ssrf
info:
name: AVTECH DVR - SSRF
author: ritikchaddha
severity: medium
description: |
AVTECH DVR device, Search.cgi can be accessed directly. Search.cgi is responsible for searching and accessing cameras in the local network. Search.cgi provides the cgi_query function.
metadata:
verified: true
max-request: 1
shodan-query: title:"login" product:"Avtech"
fofa-query: app="AVTECH-视频监控"
tags: ssrf,avtech,unauth,iot
http:
- method: GET
path:
- "{{BaseURL}}/cgi-bin/nobody/Search.cgi?action=scan"
matchers-condition: and
matchers:
- type: word
part: body
words:
- 'Search.Device'
- 'Proto='
- 'IPAddress='
condition: and
- type: word
part: header
words:
- text/plain
- type: status
status:
- 200
# digest: 4a0a00473045022078b69653877ec53ae750f01e36c920eb9a7721b11916e4781b40b5e0f3b2850a022100b94b62256c9459b13534ed43ac5f775c35c3ed28596b6d62bada0183b24ea87a:922c64590222798bb761d5b6d8e72950