SourceCodester Apartment Visitor Management System 1.0 index.php username SQL注入

SourceCodester Apartment Visitor Management System 1.0中曾发现一漏洞,此漏洞被分类为致命。 此漏洞会影响未知部件文件 index.php。 手动调试的软件参数:username使用输入:' AND (SELECT 4955 FROM (SELECT(SLEEP(5)))RSzF) AND 'htiy'='htiy不合法输入可导致 SQL注入。 漏洞的CWE定义是 CWE-89。 此漏洞的脆弱性 2022-08-05所公布。 分享公告的网址是github.com。 该漏洞唯一标识为CVE-2022-2677, 可以发起远程攻击, 有技术细节可用。 此外还有一个漏洞可利用。 该漏洞利用已公开,可能会被利用。 当前漏洞利用价值为美元大约是 $0-$5k。 MITRE ATT&CK项目使用攻击技术T1505来解决该问题。 它被宣布为proof-of-concept。 该漏洞利用的共享下载地址为:github.com。 我们估计的零日攻击价值约为$0-$5k。 该漏洞被披露后,此前未曾发表过可能的缓解措施。

字段2022-08-05 20時46分2022-08-30 15時20分
vendorSourceCodesterSourceCodester
nameApartment Visitor Management SystemApartment Visitor Management System
version1.01.0
fileindex.phpindex.php
argumentusernameusername
cwe89 (SQL注入)89 (SQL注入)
risk22
cvss3_vuldb_avNN
cvss3_vuldb_acLL
cvss3_vuldb_uiNN
cvss3_vuldb_sUU
cvss3_vuldb_cLL
cvss3_vuldb_iLL
cvss3_vuldb_aLL
cvss3_vuldb_ePP
cvss3_vuldb_rcRR
urlhttps://github.com/anx0ing/CVE_demo/blob/main/2022/Apartment%20Visitor%20Management%20System-SQL%20injections.mdhttps://github.com/anx0ing/CVE_demo/blob/main/2022/Apartment%20Visitor%20Management%20System-SQL%20injections.md
availability11
publicity11
urlhttps://github.com/anx0ing/CVE_demo/blob/main/2022/Apartment%20Visitor%20Management%20System-SQL%20injections.mdhttps://github.com/anx0ing/CVE_demo/blob/main/2022/Apartment%20Visitor%20Management%20System-SQL%20injections.md
cveCVE-2022-2677CVE-2022-2677
responsibleVulDBVulDB
date1659650400 (2022-08-05)1659650400 (2022-08-05)
cvss2_vuldb_avNN
cvss2_vuldb_acLL
cvss2_vuldb_ciPP
cvss2_vuldb_iiPP
cvss2_vuldb_aiPP
cvss2_vuldb_ePOCPOC
cvss2_vuldb_rcURUR
cvss2_vuldb_auSS
cvss2_vuldb_rlNDND
cvss3_vuldb_prLL
cvss3_vuldb_rlXX
cvss2_vuldb_basescore6.56.5
cvss2_vuldb_tempscore5.65.6
cvss3_vuldb_basescore6.36.3
cvss3_vuldb_tempscore5.75.7
cvss3_meta_basescore6.36.3
cvss3_meta_tempscore5.75.7
price_0day$0-$5k$0-$5k
input_value' AND (SELECT 4955 FROM (SELECT(SLEEP(5)))RSzF) AND 'htiy'='htiy' AND (SELECT 4955 FROM (SELECT(SLEEP(5)))RSzF) AND 'htiy'='htiy
cve_assigned1659650400 (2022-08-05)
cve_nvd_summaryA vulnerability was found in SourceCodester Apartment Visitor Management System 1.0. It has been classified as critical. This affects an unknown part of the file index.php. The manipulation of the argument username with the input ' AND (SELECT 4955 FROM (SELECT(SLEEP(5)))RSzF) AND 'htiy'='htiy leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-205665 was assigned to this vulnerability.

Might our Artificial Intelligence support you?

Check our Alexa App!