GravCMS_Nmap_Script

这是一个针对 GravCMS 漏洞（CVE-2021-21425）的 nmap 脚本

用法

-- nmap -p443 --script grav_cms.nse <目标>

-- PORT STATE SERVICE

-- 443/tcp open https

-- | grav_cms:

-- | VULNERABLE:

-- | GravCMS (CVE-2021-21425)

-- | State: VULNERABLE (可利用)

-- | IDs: CVE:CVE-2021-21425

-- | GravCMS 未认证任意 YAML 写入/更新导致代码执行

-- | Disclosure date: 2021-03-19

-- | References:

-- | https://pentest.blog/unexpected-journey-7-gravcms-unauthenticated-arbitrary-yaml-write-update-leads-to-code-execution/

-- |_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21425