cbcvebase.
CVE-2022-27985
published 2022-04-26

CVE-2022-27985: CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via /administrator/alerts/alertLightbox.php.

PriorityP260critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
6.92%
93.3th percentile
CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via /administrator/alerts/alertLightbox.php.

Affected

1 ranges
VendorProductVersion rangeFixed in
cuppacmscuppacms——

Detection & IOCsextracted from sources · hover to see the quote

path/administrator/alerts/alertLightbox.php↗
path/alerts/alertLightbox.php
commandurl=components%2Fpermissions%2Flist_permissions_lightbox.php&title=Permissions%3A+profile&params%5Bgroup%5D=3'+UNION+ALL+SELECT+md5('{{num}}'),null--+-&params%5Breference%5D=41&uniqueClass=new_content_3983163
  • →Detect exploitation attempts by monitoring POST requests to /alerts/alertLightbox.php or /administrator/alerts/alertLightbox.php containing UNION-based SQL injection payloads in the 'params[group]' parameter.
  • →The attack is authenticated; monitor for a preceding POST login request to '/' with fields user, password, language, and task=login, followed immediately by the injection request.
  • →The Content-Type header 'application/x-www-form-urlencoded; charset=UTF-8' is used in the injection request; correlate with the uniqueClass parameter value 'new_content_3983163' as a fingerprint of the exploit template.
  • →Successful exploitation returns HTTP 200 with a text/html Content-Type and an md5 hash value in the response body; monitor for md5 hash strings in responses from alertLightbox.php.
  • ·The exploit requires prior authentication; the SQL injection is only reachable after a valid login session is established via the CuppaCMS login endpoint.
  • ·The vulnerability is confirmed only against CuppaCMS v1.0 (CPE: cpe:2.3:a:cuppacms:cuppacms:1.0).

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.