id: php-composer-binary

info:
  name: PHP Composer Binary - Exposure
  author: mayank_pandey01
  severity: info
  description: |
    This Nuclei template checks if the specified endpoints have publically accessible PHP Composer Binary.
  remediation: |
    Restrict access to the PHP Composer binary by implementing proper access controls and permissions.
  metadata:
    verified: true
    max-request: 1
  tags: php,composer,exposure,misconfig

http:
  - method: GET
    path:
      - "{{BaseURL}}/composer"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "/usr/bin/env php"
          - "<?php"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100e1749c03e8858b283bb5298041e9ee4ae64529dabd69f6dc52bedd1de171f34c022016727e4c5248a087aab8ade44869bd93da353a63114dfc9a7400f92e0a49945a:922c64590222798bb761d5b6d8e72950