cbcvebase.
CVE-2022-27984
published 2022-04-26

CVE-2022-27984: CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via the menu_filter parameter at /administrator/templates/default/html/windows/right.php.

PriorityP261critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
6.92%
93.3th percentile
CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via the menu_filter parameter at /administrator/templates/default/html/windows/right.php.

Affected

1 ranges
VendorProductVersion rangeFixed in
cuppacmscuppacms——

Detection & IOCsextracted from sources · hover to see the quote

path/administrator/templates/default/html/windows/right.php↗
path/templates/default/html/windows/right.php
commandmenu_filter=3'+AND+SLEEP(6)--+-&id=211&url=components%2Fmenu%2Fhtml%2Fedit.php&path=component%2Fmenu%2F%26menu_filter%3D3&uniqueClass=window_right_7526357
  • →Detect time-based blind SQL injection attempts against CuppaCMS: look for POST requests to /templates/default/html/windows/right.php containing SLEEP() in the menu_filter parameter body.
  • →Successful exploitation responses contain the string 'components/menu/classes/functions.php' in the HTTP response body; use this as a confirmation indicator.
  • →Exploitation requires prior authentication; monitor for a POST login request to / with parameters user, password, language, and task=login immediately before the injection request.
  • →Response duration >= 6 seconds on the POST to right.php is a strong indicator of successful time-based SQL injection exploitation.
  • ·The vulnerability is authenticated (requires valid CuppaCMS credentials); unauthenticated scanning will not reach the vulnerable endpoint.
  • ·The Nuclei template uses a 20-second timeout for the injection request to accommodate the SLEEP(6) payload with network latency headroom.
  • ·Detection relies on a time-based (blind) technique; network jitter or server load may cause false positives or false negatives when using duration-based matching.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.