id: batflat-sqlite-exposure

info:
  name: Batflat SQLite Database - Exposure
  author: DhiyaneshDk
  severity: high
  description: |
    Detected exposed Batflat CMS SQLite database files that may contain sensitive information including admin credentials, user data, site configuration, and content. Batflat stores its database in the /inc/data/ directory by default.
  reference:
    - https://batflat.org/
    - https://github.com/sruupl/batflat
  classification:
    cwe-id: CWE-219,CWE-552
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"Batflat"
  tags: batflat,database,sqlite,unauth,backup,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}/inc/data/database.sdb"

    matchers-condition: and
    matchers:
      - type: binary
        binary:
          - "53514c69746520666f726d6174203300"  # "SQLite format 3\0" hex
        part: body

      - type: status
        status:
          - 200
# digest: 490a00463044022076f8e6232eaec37e5008504b0fea523843033c16549829e5403cd11f3f088d3d02203a0a7fe7e8ffba82b35d1084447eff55a15ce4cde24be7978eb84ae2a8a0036a:922c64590222798bb761d5b6d8e72950