2023-08-18 08:55:46 +02:00
id : pbootcms-database-file-download
info :
name : PbootCMS 2.0.7 - SQL Injection
author : ritikchaddha
severity : critical
description : PbootCMS 2.0.7 contains a SQL injection vulnerability via pbootcms.db. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
reference :
- https://xz.aliyun.com/t/7628
- https://www.cnblogs.com/0daybug/p/12786036.html
classification :
cvss-metrics : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
2023-11-01 09:00:03 +01:00
cvss-score : 10
2023-08-18 08:55:46 +02:00
cwe-id : CWE-89
metadata :
max-request : 1
2023-11-01 09:00:03 +01:00
tags : pbootcms,db,exposure,database,sqlite
2023-08-18 08:55:46 +02:00
http :
- method : GET
path :
- "{{BaseURL}}/data/pbootcms.db"
max-size : 20000
2023-11-01 09:00:03 +01:00
2023-08-18 08:55:46 +02:00
matchers-condition : and
matchers :
- type : word
part : body
words :
- "PbootCMS"
- "SQLite format 3"
condition : and
- type : status
status :
- 200
2023-11-01 09:00:03 +01:00
# digest: 4b0a00483046022100d3d6817f5ef153a11819b3b25cc8cbb2b86775f9c41c57d52bcb228c84662786022100d980c25d1e941dce7e07856b34886409f80a611250fe4dcfa5193b7aa30cffd2:922c64590222798bb761d5b6d8e72950
