xoops-installer: XOOPS Installation Page - Exposure

2026-07-09 xoops-installer PoC Public

Description

Detects exposed XOOPS Installation page.

PoC

id: xoops-installer

info:
  name: XOOPS Installation Page - Exposure
  author: princechaddha
  severity: high
  description: |
    Detects exposed XOOPS Installation page.
  classification:
    cpe: cpe:2.3:a:xoops:xoops:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: xoops
    product: xoops
  tags: misconfig,install,exposure,xoops,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/install/page_start.php"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "(?i)(<title>(.*)XOOPS Installation Wizard(.*)</title>)"
          - "(?i)(<title>(.*)XOOPS 安裝精靈(.*)</title>)"
        condition: or
# digest: 4a0a00473045022100b5c0140dc3b04634fb6dfe9fa5afcc56ec09dc153ad9bf67054d86c85b3bf47f02204a7f6f85034e949833f1f3e33f9917f8d385087f6b6b7474dfab372694b5a749:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/misconfiguration/installer/xoops-installer.yaml

References

Related Vulnerabilities