.. / CVE-2014-8682

• SQLi
• PoC
• Nuclei
• Web
• Hack The Box

Exploit for Gogs (Go Git Service) - SQL Injection (CVE-2014-8682)

Description:

Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly handled in models/user.go.

Nuclei Template

View the template here CVE-2014-8682.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2014/CVE-2014-8682.yaml

Try the exploit in a lab environment:

References: