2023-10-17 07:20:28 +00:00
id : phuket-cms-sqli
info :
name : Phuket Solution CMS - SQL Injection
author : r3Y3r53
severity : high
description : |
Phuket Solutions CMS is vulnerable to sql injection in which an attacker is able to manipulate an SQL query through user input, causing the application to execute unintended SQL code.
reference :
- https://www.exploitalert.com/view-details.html?id=36234
metadata :
2023-10-17 17:52:26 +00:00
verified : true
2023-10-17 08:16:05 +00:00
max-request : 2
2023-10-17 07:20:28 +00:00
google-dork : intext:"Developed by Phuket Solution"
tags : phuket,sqli,phuket-cms
http :
- raw :
- |
GET /properties-list.php HTTP/1.1
Host : {{Hostname}}
- |
GET /properties-list.php?property-types=%27 HTTP/1.1
Host : {{Hostname}}
matchers :
- type : dsl
dsl :
- 'status_code_2 == 200'
- 'contains(content_type_2, "text/html")'
- 'contains(body_2, "You have an error in your SQL syntax") && contains(body_1, "Phuket Solution")'
condition : and
2023-10-20 11:41:13 +00:00
# digest: 490a0046304402204fa392d3690c667521c148f540460ecf82abb63f25eb184e329454a554287ceb02206797687c70ece303d7f96881f3e0d8d756bb201910575568eaa8c2f8b7fdcad7:922c64590222798bb761d5b6d8e72950
