SourceCodester Apartment Visitor Management System 1.0 index.php username SQL注入

CVSS 元温度得分当前攻击价格 (≈)CTI兴趣分数
5.7$0-$5k0.17

一览

SourceCodester Apartment Visitor Management System 1.0中曾发现一漏洞,此漏洞被分类为致命。 此漏洞会影响未知部件文件 index.php。 手动调试的软件参数:username使用输入:' AND (SELECT 4955 FROM (SELECT(SLEEP(5)))RSzF) AND 'htiy'='htiy不合法输入可导致 SQL注入。 漏洞的CWE定义是 CWE-89。 此漏洞的脆弱性 2022-08-05所公布。 分享公告的网址是github.com。 该漏洞唯一标识为CVE-2022-2677, 可以发起远程攻击, 有技术细节可用。 此外还有一个漏洞可利用。 该漏洞利用已公开,可能会被利用。 当前漏洞利用价值为美元大约是 $0-$5k。 MITRE ATT&CK项目使用攻击技术T1505来解决该问题。 它被宣布为proof-of-concept。 该漏洞利用的共享下载地址为:github.com。 我们估计的零日攻击价值约为$0-$5k。 该漏洞被披露后,此前未曾发表过可能的缓解措施。 [细节]

IOB - Indicator of Behavior (811)

活动

IOC - Indicator of Compromise (11)

These indicators of compromise highlight associated network ranges which are known to be part of research and attack activities.

IDIP range参与者类型可信度
135.204.33.0/24Toddlerpredictive
238.132.96.0/24Contipredictive
3xx.xx.xxx.xXxxxxpredictive
4xx.xx.xxx.xXxxxxpredictive
5xxx.xx.xx.xXxxxxpredictive
6xxx.xxx.xxx.xXxxxxpredictive
7xxx.xxx.xxx.xXxxxxpredictive
8xxx.xx.xx.xXxxxxpredictive
9xxx.xxx.xxx.xXxxxxpredictive
10xxx.xxx.xx.xXxxxxpredictive
11xxx.xx.xxx.xXxxxxpredictive

TTP - Tactics, Techniques, Procedures (1)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechnique漏洞访问向量类型可信度
1T1505CWE-89SQL Injectionpredictive

IOA - Indicator of Attack (3)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID分类Indicator类型可信度
1Fileindex.phppredictive
2Argumentxxxxxxxxpredictive
3Input Value' xxx (xxxxxx xxxx xxxx (xxxxxx(xxxxx(x)))xxxx) xxx 'xxxx'='xxxxpredictive

Interested in the pricing of exploits?

See the underground prices here!