New vulnerability module for Triofox CVE-2025-12480 detection

docs/Modules.md

@@ -162,6 +162,7 @@ If you want to scan all ports please define -g 1-65535 range. Otherwise Nettacke
 - '**ssl_expired_certificate_vuln**' - check if SSL certificate has expired or is close to expiring
 - '**ssl_version_vuln**' - check if the server's SSL configuration supports old and insecure SSL versions
 - '**ssl_weak_cipher_vuln**' - check if server's SSL configuration supports weak cipher suites
+- '**triofox_improper_access_control_cve_2025_12480_vuln**' - Checks for an unauthenticated improper access control vulnerability in Gladinet Triofox
 - '**wordpress_dos_cve_2018_6389_vuln**' - check if Wordpress is vulnerable to CVE-2018-6389 Denial Of Service (DOS)
 - '**wp_plugin_cve_2023_47668_vuln**' - check the target for CVE-2023-47668
 - '**wp_xmlrpc_bruteforce_vuln**' - check if Wordpress is vulnerable to credential Brute Force via XMLRPC wp.getUsersBlogs

nettacker/modules/vuln/triofox_improper_access_cve_2025_12480.yaml

@@ -0,0 +1,58 @@
+info:
+  name: triofox_improper_access_control_cve_2025_12480_vuln
+  author: OWASP Nettacker Team
+  severity: 9.8
+  description: |
+    Gladinet Triofox before version 12.91.1126.65588 and CentreStack before
+    version 12.10.595.65696 allow unauthenticated access to the
+    /management/admindatabase.aspx endpoint. An unauthenticated attacker
+    can access sensitive database management functionality, leading to
+    potential data disclosure or system compromise.
+  reference:
+    - https://cloud.google.com/blog/topics/threat-intelligence/triofox-vulnerability-cve-2025-12480
+    - https://attackerkb.com/topics/5C4wRy6hY7/cve-2025-12480/rapid7-analysis
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-12480
+  profiles:
+    - vuln
+    - http
+    - critical_severity
+    - cve
+    - cve2025
+    - unauth
+    - exposure
+    - triofox
+    - kev
+
+payloads:
+  - library: http
+    steps:
+      - method: get
+        timeout: 5
+        headers:
+          User-Agent: "{user_agent}"
+        allow_redirects: false
+        ssl: false
+        url:
+          nettacker_fuzzer:
+            input_format: "{{schema}}://{target}:{{ports}}{{paths}}"
+            prefix: ""
+            suffix: ""
+            interceptors: []
+            data:
+              schema:
+                - http
+                - https
+              ports:
+                - 80
+                - 443
+              paths:
+                - "/management/admindatabase.aspx"
+        response:
+          condition_type: and
+          conditions:
+            status_code:
+              regex: "200"
+              reverse: false
+            content:
+              regex: "(?s)(Triofox Enterprise).*?(Manage Database).*?(Configure Database)"
+              reverse: false