From eb6cf4aad87e7abc89dbd9e15c1317ab2dfe74b0 Mon Sep 17 00:00:00 2001 From: Aarush289 Date: Thu, 22 Jan 2026 22:06:41 +0530 Subject: [PATCH 1/4] New Module added --- docs/Modules.md | 1 + ...riofox_improper_access_cve_2025_12480.yaml | 58 +++++++++++++++++++ 2 files changed, 59 insertions(+) create mode 100644 nettacker/modules/vuln/triofox_improper_access_cve_2025_12480.yaml diff --git a/docs/Modules.md b/docs/Modules.md index 43cdebcce..3ca7426ec 100644 --- a/docs/Modules.md +++ b/docs/Modules.md @@ -162,6 +162,7 @@ If you want to scan all ports please define -g 1-65535 range. Otherwise Nettacke - '**ssl_expired_certificate_vuln**' - check if SSL certificate has expired or is close to expiring - '**ssl_version_vuln**' - check if the server's SSL configuration supports old and insecure SSL versions - '**ssl_weak_cipher_vuln**' - check if server's SSL configuration supports weak cipher suites +- '**triofox_improper_access_control_cve_2025_12480_vuln**' - Checks for an unauthenticated improper access control vulnerability in Gladinet Triofox - '**wordpress_dos_cve_2018_6389_vuln**' - check if Wordpress is vulnerable to CVE-2018-6389 Denial Of Service (DOS) - '**wp_plugin_cve_2023_47668_vuln**' - check the target for CVE-2023-47668 - '**wp_xmlrpc_bruteforce_vuln**' - check if Wordpress is vulnerable to credential Brute Force via XMLRPC wp.getUsersBlogs diff --git a/nettacker/modules/vuln/triofox_improper_access_cve_2025_12480.yaml b/nettacker/modules/vuln/triofox_improper_access_cve_2025_12480.yaml new file mode 100644 index 000000000..7465c4788 --- /dev/null +++ b/nettacker/modules/vuln/triofox_improper_access_cve_2025_12480.yaml @@ -0,0 +1,58 @@ +info: + name: triofox_improper_access_control_cve_2025_12480_vuln + author: OWASP Nettacker Team + severity: 9.8 + description: | + Gladinet Triofox before version 12.91.1126.65588 and CentreStack before + version 12.10.595.65696 allow unauthenticated access to the + /management/admindatabase.aspx endpoint. An unauthenticated attacker + can access sensitive database management functionality, leading to + potential data disclosure or system compromise. + reference: + - https://cloud.google.com/blog/topics/threat-intelligence/triofox-vulnerability-cve-2025-12480 + - https://attackerkb.com/topics/5C4wRy6hY7/cve-2025-12480/rapid7-analysis + - https://nvd.nist.gov/vuln/detail/CVE-2025-12480 + profiles: + - vuln + - http + - critical_severity + - cve + - cve2025 + - unauth + - exposure + - triofox + - kev + +payloads: + - library: http + steps: + - method: get + timeout: 5 + headers: + User-Agent: "{user_agent}" + allow_redirects: false + ssl: false + url: + nettacker_fuzzer: + input_format: "{{schema}}://{target}:{{ports}}{{paths}}" + prefix: "" + suffix: "" + interceptors: [] + data: + schema: + - http + - https + ports: + - 80 + - 443 + paths: + - "/management/admindatabase.aspx" + response: + condition_type: and + conditions: + status_code: + regex: "200" + reverse: false + content: + regex: "(?s)(?=.*Triofox Enterprise)(?=.*Manage Database)(?=.*Configure Database)" + reverse: false \ No newline at end of file From 7582816ade3a07ef49aee2c51c44cd29b4e5b06a Mon Sep 17 00:00:00 2001 From: Aarush289 Date: Thu, 22 Jan 2026 22:39:06 +0530 Subject: [PATCH 2/4] Regex updated to have proper logs --- .../modules/vuln/triofox_improper_access_cve_2025_12480.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nettacker/modules/vuln/triofox_improper_access_cve_2025_12480.yaml b/nettacker/modules/vuln/triofox_improper_access_cve_2025_12480.yaml index 7465c4788..10a27da0a 100644 --- a/nettacker/modules/vuln/triofox_improper_access_cve_2025_12480.yaml +++ b/nettacker/modules/vuln/triofox_improper_access_cve_2025_12480.yaml @@ -54,5 +54,5 @@ payloads: regex: "200" reverse: false content: - regex: "(?s)(?=.*Triofox Enterprise)(?=.*Manage Database)(?=.*Configure Database)" + regex: "(?s)(Triofox Enterprise).*?(Manage Database).*?(Configure Database)" reverse: false \ No newline at end of file From 66d0efe5c5245a244e7bdb45fe3b11fe3d5572f6 Mon Sep 17 00:00:00 2001 From: Aarush Date: Fri, 23 Jan 2026 00:00:59 +0530 Subject: [PATCH 3/4] Severity updated Signed-off-by: Aarush --- .../modules/vuln/triofox_improper_access_cve_2025_12480.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nettacker/modules/vuln/triofox_improper_access_cve_2025_12480.yaml b/nettacker/modules/vuln/triofox_improper_access_cve_2025_12480.yaml index 10a27da0a..8b1ec5a58 100644 --- a/nettacker/modules/vuln/triofox_improper_access_cve_2025_12480.yaml +++ b/nettacker/modules/vuln/triofox_improper_access_cve_2025_12480.yaml @@ -1,7 +1,7 @@ info: name: triofox_improper_access_control_cve_2025_12480_vuln author: OWASP Nettacker Team - severity: 9.8 + severity: 9.1 description: | Gladinet Triofox before version 12.91.1126.65588 and CentreStack before version 12.10.595.65696 allow unauthenticated access to the @@ -55,4 +55,4 @@ payloads: reverse: false content: regex: "(?s)(Triofox Enterprise).*?(Manage Database).*?(Configure Database)" - reverse: false \ No newline at end of file + reverse: false From c37e366ccfed52b308cf6ddf95d3f82732584315 Mon Sep 17 00:00:00 2001 From: Aarush289 Date: Thu, 30 Jul 2026 12:26:52 +0530 Subject: [PATCH 4/4] minor fixes --- docs/Modules.md | 2 +- .../modules/vuln/triofox_improper_access_cve_2025_12480.yaml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/Modules.md b/docs/Modules.md index 6a42395d7..e6345a6a2 100644 --- a/docs/Modules.md +++ b/docs/Modules.md @@ -247,7 +247,7 @@ If you want to scan all ports please define -g 1-65535 range. Otherwise Nettacke - '**teamcity_cve_2024_27198_vuln**' – check the target for TeamCity CVE-2024-27198 vulnerability - '**tieline_cve_2021_35336_vuln**' – check the target for Tieline CVE-2021-35336 vulnerability - '**tjws_cve_2021_37573_vuln**' – check the target for TJWS CVE-2021-37573 vulnerability -- '**triofox_improper_access_control_cve_2025_12480_vuln**' - Checks for an unauthenticated improper access control vulnerability in Gladinet Triofox +- '**triofox_improper_access_cve_2025_12480_vuln**' - Checks for an unauthenticated improper access control vulnerability in Gladinet Triofox - '**vbulletin_cve_2019_16759_vuln**' – check the target for vBulletin CVE-2019-16759 vulnerability - '**wp_plugin_cve_2021_38314_vuln**' – check the target for WordPress plugin CVE-2021-38314 - '**wp_plugin_cve_2021_39316_vuln**' – check the target for WordPress plugin CVE-2021-39316 diff --git a/nettacker/modules/vuln/triofox_improper_access_cve_2025_12480.yaml b/nettacker/modules/vuln/triofox_improper_access_cve_2025_12480.yaml index 8b1ec5a58..91a8cead3 100644 --- a/nettacker/modules/vuln/triofox_improper_access_cve_2025_12480.yaml +++ b/nettacker/modules/vuln/triofox_improper_access_cve_2025_12480.yaml @@ -1,5 +1,5 @@ info: - name: triofox_improper_access_control_cve_2025_12480_vuln + name: triofox_improper_access_cve_2025_12480_vuln author: OWASP Nettacker Team severity: 9.1 description: | @@ -21,7 +21,7 @@ info: - unauth - exposure - triofox - - kev + - cisa_kev payloads: - library: http