CVE-2022-37122 Path Traversal Scanner

A robust and feature-rich scanner for detecting the Carel pCOWeb logdownload.cgi path traversal vulnerability (CVE-2022-37122). Designed for security researchers and authorized penetration testers.

🚨 Important Notice

EDUCATIONAL / BUG BOUNTY USE ONLY

This tool is intended for:

• Educational purposes
• Authorized security testing
• Bug bounty hunting with explicit permission

DO NOT use this tool against systems you do not own or lack explicit written permission to test.

✨ Features

• 🎯 Safe Default Payload: Uses /etc/hostname (non-sensitive file) for responsible testing
• 🚀 High Performance: Multi-threaded scanning with configurable concurrency
• 📊 Comprehensive Reporting: CSV output with detailed findings
• 💾 Evidence Collection: Automatically saves response samples for validation
• 🎨 User-Friendly: Color-coded output with progress indicators and summary
• 🔧 Flexible: Support for single targets or target lists
• 🛡️ Safe: Built-in safeguards and clear responsible usage warnings

📋 Requirements

• bash (v4.0+)
• curl
• figlet (for banner - automatically installed)

🛠️ Installation

git clone https://github.com/bughuntar/cve-2022-37122-scanner.git
cd cve-2022-37122-scanner
chmod +x cve-2022-37122-scanner.sh

📖 Usage

Basic Single Target Scan

./cve-2022-37122-scanner.sh -u http://target-ip

Scan Multiple Targets

./cve-2022-37122-scanner.sh -f targets.txt -t 16 -o results.csv

Advanced Options

./cve-2022-37122-scanner.sh \
  -u https://device.local \
  -p '../../../../../../../../etc/passwd' \
  --insecure \
  -v \
  -t 20 \
  -o detailed_findings.csv

⚙️ Options

📁 Output

CSV Format

The scanner generates a CSV file with the following columns:

• host: Target host URL
• url: Full exploitation URL
• status: Vulnerability status (VULNERABLE, POSSIBLE, NOT_DETECTED, ERROR)
• matched_pattern: Detection pattern matched
• sample_file: Path to response sample

Sample Directory

Response samples are saved in the specified directory for manual verification and evidence collection.

🎯 Detection Logic

The scanner uses multiple detection methods:

1. Primary Detection: Validates hostname format in response
2. Keyword Matching: Looks for common system file indicators
3. Response Analysis: Examines full response content

🔒 Responsible Usage

Default Safe Payload

The scanner defaults to reading /etc/hostname which:

• Is non-sensitive
• Confirms vulnerability without exposing sensitive data
• Maintains ethical testing standards

Custom Payloads

If using custom payloads, ensure:

• You have explicit permission to access targeted files
• You comply with all applicable laws and regulations
• You follow responsible disclosure practices

🎓 Educational Value

This tool demonstrates:

• Path traversal vulnerability exploitation
• Safe vulnerability verification techniques
• Mass scanning with concurrency control
• Professional reporting and evidence collection
• Ethical security testing practices

👨‍💻 Author

Professor the Hunter

• Twitter: @bughuntar
• GitHub: Professor the Hunter

🤝 Contributing

Contributions are welcome! Please:

1. Fork the repository
2. Create a feature branch
3. Submit a pull request
4. Ensure code follows existing style and safety guidelines

⚠️ Disclaimer

This tool is provided for educational and authorized testing purposes only. The author is not responsible for any misuse or damage caused by this program. Always obtain proper authorization before conducting security testing.