nuclei-templates/cves/2020/CVE-2020-36112.yaml

id: CVE-2020-36112

info:
  name: CSE Bookstore 1.0 SQL Injection
  author: geeknik
  description: CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pubid parameter in bookPerPub.php. A successful exploitation of this vulnerability will lead to an attacker dumping the entire database.
  reference:
    - https://www.exploit-db.com/exploits/49314
    - https://www.tenable.com/cve/CVE-2020-36112
  severity: critical
  tags: cve,cve2020,sqli,cse

requests:
  - raw:
      - |
        GET /ebook/bookPerPub.php?pubid=4' HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - "get book price failed! You have an error in your SQL syntax"
          - "Can't retrieve data You have an error in your SQL syntax"
        condition: or
Create CVE-2020-36112.yaml 2021-05-18 22:56:54 +00:00			`id: CVE-2020-36112`

			`info:`
			`name: CSE Bookstore 1.0 SQL Injection`
			`author: geeknik`
Spelling 2021-06-02 06:39:35 +00:00			`description: CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pubid parameter in bookPerPub.php. A successful exploitation of this vulnerability will lead to an attacker dumping the entire database.`
Removed pipe (\|) character from references, because the structure requires it to be a string slice, not a string Related nuclei tickets: * #259 - dynamic key-value field support for template information * #940 - new infos in template * #834 * RES-84 2021-08-18 11:37:49 +00:00			`reference:`
Satisfying the linter (all errors and warnings) * whitespace modifications only 2021-08-19 14:44:46 +00:00			`- https://www.exploit-db.com/exploits/49314`
			`- https://www.tenable.com/cve/CVE-2020-36112`
Removing additional requests 2021-05-19 01:20:49 +00:00			`severity: critical`
Create CVE-2020-36112.yaml 2021-05-18 22:56:54 +00:00			`tags: cve,cve2020,sqli,cse`

			`requests:`
			`- raw:`
			`- \|`
			`GET /ebook/bookPerPub.php?pubid=4' HTTP/1.1`
			`Host: {{Hostname}}`

			`matchers:`
			`- type: word`
			`part: body`
			`words:`
			`- "get book price failed! You have an error in your SQL syntax"`
			`- "Can't retrieve data You have an error in your SQL syntax"`
			`condition: or`