CVE-2019-9762 PoC — 灵宝简好网络科技 PHPSHE SQL注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9762.yaml

Associated Vulnerability

Title:灵宝简好网络科技 PHPSHE SQL注入漏洞 (CVE-2019-9762)
Description:灵宝简好网络科技 PHPSHE是中国灵宝简好网络科技公司的一套网上商城系统。该系统支持快递跟踪、在线聊天、订单评价和数据统计等功能。灵宝简好网络科技 PHPSHE 1.7版本中的include/plugin/payment/alipay/pay.php文件存在SQL注入漏洞。远程攻击者可借助‘id’参数利用该漏洞执行SQL命令。

Description

A SQL Injection was discovered in PHPSHE 1.7 in include/plugin/payment/alipay/pay.php with the parameter id. The vulnerability does not need any authentication.

File Snapshot


 id: CVE-2019-9762

info:
  name: PHPSHE 1.7 -  SQL Injection
  author: DhiyaneshDK
  severity: criti

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!