adminer-panel: Adminer Login Panel

id: adminer-panel

info:
  name: Adminer Login Panel
  author: random_robbie,meme-lord
  severity: info
  verified: true
  description: |-
    An Adminer login panel was detected.
    fofa: app="Adminer"
  reference:
    - https://blog.sorcery.ie/posts/adminer/
  tags: adminer,panel
  created: 2023/06/17

rules:
  r0:
    request:
      method: GET
      path: /adminer.php
      headers:
        Accept-Language: en-US,en;q=0.5
    expression: response.status == 200 && response.body.bcontains(b'Login - Adminer') && "<span class=\"version\">([0-9.]+)".bmatches(response.body)
  r1:
    request:
      method: GET
      path: /_adminer.php
      headers:
        Accept-Language: en-US,en;q=0.5
    expression: response.status == 200 && response.body.bcontains(b'Login - Adminer') && "<span class=\"version\">([0-9.]+)".bmatches(response.body)
  r2:
    request:
      method: GET
      path: /adminer/
      headers:
        Accept-Language: en-US,en;q=0.5
    expression: response.status == 200 && response.body.bcontains(b'Login - Adminer') && "<span class=\"version\">([0-9.]+)".bmatches(response.body)
  r3:
    request:
      method: GET
      path: /editor.php
      headers:
        Accept-Language: en-US,en;q=0.5
    expression: response.status == 200 && response.body.bcontains(b'Login - Adminer') && "<span class=\"version\">([0-9.]+)".bmatches(response.body)
  r4:
    request:
      method: GET
      path: /mysql.php
      headers:
        Accept-Language: en-US,en;q=0.5
    expression: response.status == 200 && response.body.bcontains(b'Login - Adminer') && "<span class=\"version\">([0-9.]+)".bmatches(response.body)
  r5:
    request:
      method: GET
      path: /sql.php
      headers:
        Accept-Language: en-US,en;q=0.5
    expression: response.status == 200 && response.body.bcontains(b'Login - Adminer') && "<span class=\"version\">([0-9.]+)".bmatches(response.body)
  r6:
    request:
      method: GET
      path: /wp-content/plugins/adminer/adminer.php
      headers:
        Accept-Language: en-US,en;q=0.5
    expression: response.status == 200 && response.body.bcontains(b'Login - Adminer') && "<span class=\"version\">([0-9.]+)".bmatches(response.body)
expression: r0() || r1() || r2() || r3() || r4() || r5() || r6()

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.