CVE-2021-26599 PoC — ImpressCMS SQL注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26599.yaml

Associated Vulnerability

Title:ImpressCMS SQL注入漏洞 (CVE-2021-26599)
Description:ImpressCMS是一套基于MySQL的、模块化的内容管理系统（CMS）。该系统包括新闻发布、论坛和相册等模块。 ImpressCMS 1.4.3 版本及之前版本存在SQL注入漏洞，该漏洞源于 /include/findusers.php 脚本中的 groups 参数传递的用户数据没有经过充分清理。攻击者通过该漏洞可以在数据库中执行任意 SQL 查询。

Description

ImpressCMS before 1.4.3 is vulnerable to SQL injection via the groups parameter in include/findusers.php, allowing unauthenticated attackers to execute arbitrary SQL queries.

File Snapshot


 id: CVE-2021-26599

info:
  name: ImpressCMS < 1.4.3 - SQL Injection
  author: ritikchaddha
  severi

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!