openlitespeed-default-login: OpenLiteSpeed WebAdmin - Default Login

id: openlitespeed-default-login

info:
  name: OpenLiteSpeed WebAdmin - Default Login
  author: 0x_Akoko
  severity: high
  description: |
    Detected OpenLiteSpeed WebAdmin Console was using default credentials.
  reference:
    - https://www.digitalocean.com/community/tutorials/how-to-install-the-openlitespeed-web-server-on-ubuntu-18-04
  metadata:
    verified: true
    max-request: 1
    fofa-query: title="OpenLiteSpeed WebAdmin"
  tags: default-login,openlitespeed,litespeed,webadmin,vuln

variables:
  username: "admin"
  password: "123456"

http:
  - raw:
      - |
        POST /login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        userid={{username}}&pass={{password}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 302'
          - 'contains_all(header, "LSID", "LSPA", "Location: /index.php")'
        condition: and
# digest: 4a0a00473045022043e5aa7b5b833aacecace64f59c1c65e65dcd3c0eff28686de2534259d5538f50221008647c6e22843fdd741a061fe71b4a5325f80f1437ea452dca5100a45587b7b31:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.