CVE-2019-6799 --show stupity

hi team I see your CVE show wrong outcome.

[CVE-2019-6799] [http] [medium] https://mlekovita.com.pl/phpmyadmin/index.php?pma_servername=cme6lhp64vk9e0bd2dig1iysmj6zqzqem.oast.live&pma_username=2agoo2yrlDmO3ZDSA59f3FVOndf&pma_password=2agoo2yrlDmO3ZDSA59f3FVOndf&server=1 [1.5,0.1,1.6] [path="/phpmyadmin/index.php"]

also

CVE-2019-12616] [http] [medium] https://www.biedronka.pl/pl/press,id,i4nnmmggz,title,biedronkowe-oszczdnoci-p-oferta-od-08-01#page=1/phpmyadmin/

After update .Nuclei is crazy .

please fix this

[tarunKoyalwar]

this seems to only happen v3.1.4 can confirm its working fine in v3.1.3

nuclei v3.1.4

 ./nuclei -id CVE-2019-6799 -u https://mlekovita.com.pl -j --omit-raw | jq .

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.1.4

		projectdiscovery.io

[INF] Current nuclei version: v3.1.4 (latest)
[INF] Current nuclei-templates version: v9.7.2 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 61
[INF] Templates loaded for current scan: 1
[INF] Executing 1 signed templates from projectdiscovery/nuclei-templates
[INF] Targets loaded for current scan: 1
[INF] Using Interactsh Server: oast.site
{
  "template": "http/cves/2019/CVE-2019-6799.yaml",
  "template-url": "https://cloud.projectdiscovery.io/public/CVE-2019-6799",
  "template-id": "CVE-2019-6799",
  "template-path": "/Users/tarun/nuclei-templates/http/cves/2019/CVE-2019-6799.yaml",
  "template-encoded": "aWQ6IENWRS0yMDE5LTY3OTkKCmluZm86CiAgbmFtZTogcGhwTXlBZG1pbiA8NC44LjUgLSBMb2NhbCBGaWxlIEluY2x1c2lvbgogIGF1dGhvcjogcHduaHhsCiAgc2V2ZXJpdHk6IG1lZGl1bQogIGRlc2NyaXB0aW9uOiB8CiAgICBwaHBNeUFkbWluIGJlZm9yZSA0LjguNSBpcyBzdXNjZXB0aWJsZSB0byBsb2NhbCBmaWxlIGluY2x1c2lvbi4gV2hlbiB0aGUgQWxsb3dBcmJpdHJhcnlTZXJ2ZXIgY29uZmlndXJhdGlvbiBzZXR0aW5nIGlzIHNldCB0byB0cnVlLCBhbiBhdHRhY2tlciBjYW4gcmVhZCwgd2l0aCB0aGUgdXNlIG9mIGEgcm9ndWUgTXlTUUwgc2VydmVyLCBhbnkgZmlsZSBvbiB0aGUgc2VydmVyIHRoYXQgdGhlIHdlYiBzZXJ2ZXIncyB1c2VyIGNhbiBhY2Nlc3MuIFRoaXMgaXMgcmVsYXRlZCB0byB0aGUgbXlzcWwuYWxsb3dfbG9jYWxfaW5maWxlIFBIUCBjb25maWd1cmF0aW9uLCBhbmQgdGhlIGluYWR2ZXJ0ZW50IGlnbm9yaW5nIG9mIG9wdGlvbnMoTVlTUUxJX09QVF9MT0NBTF9JTkZJTCBjYWxscy4KICByZW1lZGlhdGlvbjogfAogICAgVXBncmFkZSBwaHBNeUFkbWluIHRvIHZlcnNpb24gNC44LjUgb3IgbGF0ZXIgdG8gbWl0aWdhdGUgdGhpcyB2dWxuZXJhYmlsaXR5LgogIHJlZmVyZW5jZToKICAgIC0gaHR0cHM6Ly9wYXBlci5zZWVidWcub3JnLzExMTIvI180CiAgICAtIGh0dHBzOi8vZ2l0aHViLmNvbS9waHBteWFkbWluL3BocG15YWRtaW4vY29tbWl0LzgyOGY3NDAxNThlN2JmMTRhYTRhNzQ3M2M1OTY4ZDA2MzY0ZTAzYTIKICAgIC0gaHR0cHM6Ly9jdmUubWl0cmUub3JnL2NnaS1iaW4vY3ZlbmFtZS5jZ2k/bmFtZT1DVkUtMjAxOS02Nzk5CiAgICAtIGh0dHBzOi8vZ2l0aHViLmNvbS9ybWIxMjIvcm9ndWVfbXlzcWxfc2VydmVyCiAgICAtIGh0dHBzOi8vZ2l0aHViLmNvbS92dWxuc3B5L3BocG15YWRtaW4tNC44LjQtYWxsb3dhcmJpdHJhcnlzZXJ2ZXIKICAgIC0gaHR0cHM6Ly9udmQubmlzdC5nb3YvdnVsbi9kZXRhaWwvQ1ZFLTIwMTktNjc5OQogIGNsYXNzaWZpY2F0aW9uOgogICAgY3Zzcy1tZXRyaWNzOiBDVlNTOjMuMC9BVjpOL0FDOkgvUFI6Ti9VSTpOL1M6VS9DOkgvSTpOL0E6TgogICAgY3Zzcy1zY29yZTogNS45CiAgICBjdmUtaWQ6IENWRS0yMDE5LTY3OTkKICAgIGVwc3Mtc2NvcmU6IDAuMTM5NjkKICAgIGVwc3MtcGVyY2VudGlsZTogMC45NTExOQogICAgY3BlOiBjcGU6Mi4zOmE6cGhwbXlhZG1pbjpwaHBteWFkbWluOio6KjoqOio6KjoqOio6KgogIG1ldGFkYXRhOgogICAgdmVyaWZpZWQ6IHRydWUKICAgIG1heC1yZXF1ZXN0OiA2CiAgICB2ZW5kb3I6IHBocG15YWRtaW4KICAgIHByb2R1Y3Q6IHBocG15YWRtaW4KICAgIHNob2Rhbi1xdWVyeTogdGl0bGU6InBocG15YWRtaW4iCiAgICBmb2ZhLXF1ZXJ5OiBib2R5PSJwbWFfc2VydmVybmFtZSIgJiYgYm9keT0iNC44LjQiCiAgICBodW50ZXItcXVlcnk6IGFwcC5uYW1lPSJwaHBNeUFkbWluIiYmd2ViLmJvZHk9InBtYV9zZXJ2ZXJuYW1lIiYmd2ViLmJvZHk9IjQuOC40IgogIHRhZ3M6IGN2ZSxjdmUyMDE5LHBocG15YWRtaW4sbXlzcWwsbGZyLGludHJ1c2l2ZQoKaHR0cDoKICAtIHJhdzoKICAgICAgLSB8CiAgICAgICAgR0VUIHt7cGF0aH19P3BtYV9zZXJ2ZXJuYW1lPXt7aW50ZXJhY3RzaC11cmx9fSZwbWFfdXNlcm5hbWU9MmFpbjdUN2JyV0g1Q1VxbnQ1dEY3YkFyTG5tJnBtYV9wYXNzd29yZD0yYWluN1Q3YnJXSDVDVXFudDV0RjdiQXJMbm0mc2VydmVyPTEgSFRUUC8xLjEKICAgICAgICBIb3N0OiB7e0hvc3RuYW1lfX0KCiAgICBwYXlsb2FkczoKICAgICAgcGF0aDoKICAgICAgICAtIC9pbmRleC5waHAKICAgICAgICAtIC9wbWEvaW5kZXgucGhwCiAgICAgICAgLSAvcG1kL2luZGV4LnBocAogICAgICAgIC0gL3BocE15QWRtaW4vaW5kZXgucGhwCiAgICAgICAgLSAvcGhwbXlhZG1pbi9pbmRleC5waHAKICAgICAgICAtIC9fcGhwbXlhZG1pbi9pbmRleC5waHAKCiAgICBhdHRhY2s6IGJhdHRlcmluZ3JhbQogICAgc3RvcC1hdC1maXJzdC1tYXRjaDogdHJ1ZQoKICAgIG1hdGNoZXJzLWNvbmRpdGlvbjogYW5kCiAgICBtYXRjaGVyczoKICAgICAgLSB0eXBlOiBkc2wKICAgICAgICBkc2w6CiAgICAgICAgICAtIGNvbXBhcmVfdmVyc2lvbnModmVyc2lvbiwgJzwgNC44LjUnKQoKICAgICAgLSB0eXBlOiBkc2wKICAgICAgICBkc2w6CiAgICAgICAgICAtIGNvbXBhcmVfdmVyc2lvbnModmVyc2lvbiwgJz4gMy45LjknKQoKICAgICAgLSB0eXBlOiBkc2wKICAgICAgICBkc2w6CiAgICAgICAgICAtIGNvbXBhcmVfdmVyc2lvbnMocGhwdmVyc2lvbiwgJzwgNy4zLjQnKQoKICAgICAgLSB0eXBlOiB3b3JkCiAgICAgICAgcGFydDogaW50ZXJhY3RzaF9wcm90b2NvbAogICAgICAgIHdvcmRzOgogICAgICAgICAgLSBkbnMKCiAgICAgIC0gdHlwZTogd29yZAogICAgICAgIHdvcmRzOgogICAgICAgICAgLSBteXNxbGlfcmVhbF9jb25uZWN0CgogICAgICAtIHR5cGU6IHdvcmQKICAgICAgICB3b3JkczoKICAgICAgICAgIC0gcG1hX3NlcnZlcm5hbWUKCiAgICAgIC0gdHlwZTogc3RhdHVzCiAgICAgICAgc3RhdHVzOgogICAgICAgICAgLSAyMDAKCiAgICBleHRyYWN0b3JzOgogICAgICAtIHR5cGU6IHJlZ2V4CiAgICAgICAgbmFtZTogdmVyc2lvbgogICAgICAgIGdyb3VwOiAxCiAgICAgICAgcmVnZXg6CiAgICAgICAgICAtIFw/dj0oWzAtOS5dKykKICAgICAgICBpbnRlcm5hbDogdHJ1ZQoKICAgICAgLSB0eXBlOiByZWdleAogICAgICAgIGdyb3VwOiAxCiAgICAgICAgcmVnZXg6CiAgICAgICAgICAtIFw/dj0oWzAtOS5dKykKCiAgICAgIC0gdHlwZTogcmVnZXgKICAgICAgICBuYW1lOiBwaHB2ZXJzaW9uCiAgICAgICAgZ3JvdXA6IDEKICAgICAgICByZWdleDoKICAgICAgICAgIC0gIlgtUG93ZXJlZC1CeTogUEhQLyhbMC05Ll0rKSIKICAgICAgICBpbnRlcm5hbDogdHJ1ZQogICAgICAgIHBhcnQ6IGhlYWRlcgojIGRpZ2VzdDogNGIwYTAwNDgzMDQ2MDIyMTAwZDE3ZDg5ZDBlMGYzZmY2MDI1YmY0OWJhOGRiMjAzNDYyNzk5MzUyNDM1ZTg1YWI0Y2Q3MjE5ZGU4ZGIxYjAwMTAyMjEwMGYwZGUzMTUxMzYwNmM4NmUxMjFkYmU1M2JiNzg2MDNlNDJhMzIzODNhY2NlOGZjZjA0ODBiNjQ3Yzk2YmUxM2I6OTIyYzY0NTkwMjIyNzk4YmI3NjFkNWI2ZDhlNzI5NTA=",
  "info": {
    "name": "phpMyAdmin <4.8.5 - Local File Inclusion",
    "author": [
      "pwnhxl"
    ],
    "tags": [
      "cve",
      "cve2019",
      "phpmyadmin",
      "mysql",
      "lfr",
      "intrusive"
    ],
    "description": "phpMyAdmin before 4.8.5 is susceptible to local file inclusion. When the AllowArbitraryServer configuration setting is set to true, an attacker can read, with the use of a rogue MySQL server, any file on the server that the web server's user can access. This is related to the mysql.allow_local_infile PHP configuration, and the inadvertent ignoring of options(MYSQLI_OPT_LOCAL_INFIL calls.\n",
    "reference": [
      "https://paper.seebug.org/1112/#_4",
      "https://github.com/phpmyadmin/phpmyadmin/commit/828f740158e7bf14aa4a7473c5968d06364e03a2",
      "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6799",
      "https://github.com/rmb122/rogue_mysql_server",
      "https://github.com/vulnspy/phpmyadmin-4.8.4-allowarbitraryserver",
      "https://nvd.nist.gov/vuln/detail/cve-2019-6799"
    ],
    "severity": "medium",
    "metadata": {
      "verified": true,
      "max-request": 6,
      "vendor": "phpmyadmin",
      "product": "phpmyadmin",
      "shodan-query": "title:\"phpmyadmin\"",
      "fofa-query": "body=\"pma_servername\" && body=\"4.8.4\"",
      "hunter-query": "app.name=\"phpMyAdmin\"&&web.body=\"pma_servername\"&&web.body=\"4.8.4\""
    },
    "classification": {
      "cve-id": [
        "cve-2019-6799"
      ],
      "cwe-id": null,
      "cvss-metrics": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "cvss-score": 5.9,
      "epss-score": 0.13969,
      "epss-percentile": 0.95119,
      "cpe": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*"
    },
    "remediation": "Upgrade phpMyAdmin to version 4.8.5 or later to mitigate this vulnerability.\n"
  },
  "type": "http",
  "host": "mlekovita.com.pl",
  "port": "443",
  "scheme": "https",
  "url": "https://mlekovita.com.pl",
  "path": "/pma/index.php",
  "matched-at": "https://mlekovita.com.pl/pma/index.php?pma_servername=cmelct4o47mkbd2504i03kwsfozedqeej.oast.site&pma_username=2ain7T7brWH5CUqnt5tF7bArLnm&pma_password=2ain7T7brWH5CUqnt5tF7bArLnm&server=1",
  "extracted-results": [
    "1.6",
    "1.5",
    "0.1"
  ],
  "meta": {
    "path": "/pma/index.php"
  },
  "ip": "77.55.147.59",
  "timestamp": "2024-01-09T19:51:41.941522+05:30",
  "curl-command": "curl -X 'GET' -d '' -H 'Host: mlekovita.com.pl' -H 'User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36' 'https://mlekovita.com.pl/pma/index.php?pma_servername=cmelct4o47mkbd2504i03kwsfozedqeej.oast.site&pma_username=2ain7T7brWH5CUqnt5tF7bArLnm&pma_password=2ain7T7brWH5CUqnt5tF7bArLnm&server=1'",
  "matcher-status": true
}

nuclei v3.1.3

$  nuclei -id CVE-2019-6799 -u https://mlekovita.com.pl -j --omit-raw       

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.1.3

		projectdiscovery.io

[INF] Current nuclei version: v3.1.3 (outdated)
[INF] Current nuclei-templates version: v9.7.2 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 61
[INF] Templates loaded for current scan: 1
[INF] Executing 1 signed templates from projectdiscovery/nuclei-templates
[INF] Targets loaded for current scan: 1
[INF] Using Interactsh Server: oast.me
[INF] No results found. Better luck next time!