Virtua Software Cobranca <12R - Blind SQL Injection

ID: CVE-2021-37589

Severity: high

Author: princechaddha

Tags: cve,cve2021,virtua,sqli,virtuasoftware

Description

Virtua Cobranca before 12R allows blind SQL injection on the login page.

YAML Source

id: CVE-2021-37589

info:
  name: Virtua Software Cobranca <12R - Blind SQL Injection
  author: princechaddha
  severity: high
  description: |
    Virtua Cobranca before 12R allows blind SQL injection on the login page.
  impact: |
    Successful exploitation of this vulnerability could lead to unauthorized access, data leakage, and potential compromise of the underlying system.
  remediation: |
    Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in Virtua Software Cobranca <12R.
  reference:
    - https://github.com/luca-regne/my-cves/tree/main/CVE-2021-37589
    - https://www.virtuasoftware.com.br/
    - https://www.virtuasoftware.com.br/conteudo.php?content=downloads&lang=pt-br
    - https://nvd.nist.gov/vuln/detail/CVE-2021-37589
    - https://github.com/luca-regne/public-exploits
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-37589
    cwe-id: CWE-89
    epss-score: 0.0114
    epss-percentile: 0.84701
    cpe: cpe:2.3:a:virtuasoftware:cobranca:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: virtuasoftware
    product: cobranca
    shodan-query: http.favicon.hash:876876147
    fofa-query: icon_hash=876876147
  tags: cve,cve2021,virtua,sqli,virtuasoftware

http:
  - raw:
      - |
        POST /controller/origemdb.php?idselorigem=ATIVOS HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
      - |
        POST /controller/login.php?acao=autenticar HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        X-Requested-With: XMLHttpRequest

        idusuario='&idsenha=test&tipousr=Usuario
      - |
        POST /controller/login.php?acao=autenticar HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        X-Requested-With: XMLHttpRequest

        idusuario=''&idsenha=a&tipousr=Usuario

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'contains(body_3, "Os parametros não estão informados corretamente")'
          - 'contains(body_3, "O CNPJ dos parametro não está informado corretamente")'
        condition: or

      - type: dsl
        dsl:
          - "status_code_2 == 500 && status_code_3 == 200"
# digest: 490a0046304402207257ebd16cc11b461d414923ea18531c6e77ddd5a771920e67d4b9df7483cfe5022074875206bda3c927440db7e2ce73bde2447e285729a13ade30e3004bf5976f52:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-37589.yaml"

View on Github