phuket-cms-sqli: Phuket Solution CMS - SQL Injection

id: phuket-cms-sqli

info:
  name: Phuket Solution CMS - SQL Injection
  author: r3Y3r53
  severity: high
  description: |
    Phuket Solutions CMS is vulnerable to sql injection in which an attacker is able to manipulate an SQL query through user input, causing the application to execute unintended SQL code.
  reference:
    - https://www.exploitalert.com/view-details.html?id=36234
  metadata:
    verified: true
    max-request: 2
    google-query: intext:"Developed by Phuket Solution"
  tags: phuket,sqli,phuket-cms,vuln

http:
  - raw:
      - |
        GET /properties-list.php HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /properties-list.php?property-types=%27 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(content_type_2, "text/html")'
          - 'contains(body_2, "You have an error in your SQL syntax") && contains(body_1, "Phuket Solution")'
        condition: and
# digest: 4a0a00473045022100b98a461f6cbe1bb44786430497518cc67bab867e320966d3dbdc10a29d49746f022058144212a8f3d4ea2cc3e778a4d4aa895ef4ada227e380ee768a67ed2eea9662:922c64590222798bb761d5b6d8e72950