lingchul/cve_poc_testPoC exploit for CVE-2019-13086 targeting SQL injection and file upload vulnerabilities in CSZ CMS. Includes experimental setup and reproduction code for security testing.
Reproduction and POC test code for CVE-2019-13086 vulnerability
Original CVE information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13086
Test environment: CSZ CMS architecture + php5.4 + MySQL 5.5 + Apache 2.4
Vulnerability types: SQL injection vulnerability File upload vulnerability
Brief description:
In the csrf_show_error function of \cszcms\cszcms\core\MY_Security.php,
the User-Agent field of the HTTP packet is not checked for any content before being added to the database query statement.
This becomes a point where SQL injection can be constructed.
Defense measures: Of course, promptly modify the source code to add detection of the UA field of the HTTP packet!
