Skip to content
Nuclei Templates

Phuket Solution CMS - SQL Injection

ID: phuket-cms-sqli

Severity: high

Author: r3Y3r53

Tags: phuket,sqli,phuket-cms

Description

Section titled “Description”

Phuket Solutions CMS is vulnerable to sql injection in which an attacker is able to manipulate an SQL query through user input, causing the application to execute unintended SQL code.

YAML Source

Section titled “YAML Source”
id: phuket-cms-sqli


info:
  name: Phuket Solution CMS - SQL Injection
  author: r3Y3r53
  severity: high
  description: |
    Phuket Solutions CMS is vulnerable to sql injection in which an attacker is able to manipulate an SQL query through user input, causing the application to execute unintended SQL code.
  reference:
    - https://www.exploitalert.com/view-details.html?id=36234
  metadata:
    verified: true
    max-request: 2
    google-query: intext:"Developed by Phuket Solution"
  tags: phuket,sqli,phuket-cms


http:
  - raw:
      - |
        GET /properties-list.php HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /properties-list.php?property-types=%27 HTTP/1.1
        Host: {{Hostname}}


    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(content_type_2, "text/html")'
          - 'contains(body_2, "You have an error in your SQL syntax") && contains(body_1, "Phuket Solution")'
        condition: and
# digest: 4b0a004830460221009a55c11d9ba964f424c0585a2b45652b475252153e196388d39e7d8e2f50b759022100af2c14975e4885b18d1929213af97a3ca0ffb0c9787ed371896e05dd7f863608:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/vulnerabilities/other/phuket-cms-sqli.yaml"

View on Github