CVE-2019-16996 PoC — Metinfo SQL注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16996.yaml

Associated Vulnerability

Title:Metinfo SQL注入漏洞 (CVE-2019-16996)
Description:MetInfo是中国米拓（MetInfo）公司的一套使用PHP和Mysql开发的内容管理系统（CMS）。 Metinfo 7.0.0beta版本中存在SQL注入漏洞。该漏洞源于基于数据库的应用缺少对外部输入SQL语句的验证。攻击者可利用该漏洞执行非法SQL命令。

Description

Metinfo 7.0.0 beta is susceptible to SQL Injection in app/system/product/admin/product_admin.class.php via the admin/?n=product&c=product_admin&a=dopara&app_type=shop id parameter.

File Snapshot


 id: CVE-2019-16996

info:
  name: Metinfo 7.0.0 beta - SQL Injection
  author: ritikchaddha
  severi

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!