id: php-composer-binary

info:
  name: PHP Composer Binary - Exposure
  author: mayank_pandey01
  severity: info
  description: |
    This Nuclei template checks if the specified endpoints have publically accessible PHP Composer Binary.
  remediation: |
    Restrict access to the PHP Composer binary by implementing proper access controls and permissions.
  metadata:
    verified: true
    max-request: 1
  tags: php,composer,exposure,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/composer"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "/usr/bin/env php"
          - "<?php"
        condition: and

      - type: status
        status:
          - 200
# digest: 490a004630440220647e760375f184738518478a51da36b84dddabef97263b28887afc29547f873b022073c5640b525c9cbe314850227c5a66f6e6dafd08bf3c6b13f0dbb66218204bcf:922c64590222798bb761d5b6d8e72950