dvwa-setup: DVWA Exposed Setup Page

id: dvwa-setup

info:
  name: DVWA Exposed Setup Page
  author: mayoubmalik1-blip
  severity: high
  description: A Damn Vulnerable Web Application (DVWA) setup page is exposed. An unauthenticated attacker can use the setup page to reset the database, which restores the default credentials (admin:password), and the page discloses database configuration details.
  reference:
    - https://github.com/digininja/DVWA
  metadata:
    max-request: 1
    shodan-query: "title:dvwa"
  tags: dvwa,setup,misconfig,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/setup.php'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Database Setup'
          - 'Create / Reset Database'
        condition: and

      - type: status
        status:
          - 200
# digest: 490a00463044022011df573174d156129ab2818272bef126c6cd7c37b0fafae46345a3a4e0c43ede022026fb4311524c8619a0f70fb2807257c84c54d94452f5a7a7fc8fecd2f86e9bb4:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.