.. / CVE-2022-24124

Exploit for Casdoor 1.13.0 - Unauthenticated SQL Injection (CVE-2022-24124)

Description:

Casdoor version 1.13.0 suffers from a remote unauthenticated SQL injection vulnerability via the query API in Casdoor before 1.13.1 related to the field and value parameters, as demonstrated by api/get-organizations.

Nuclei Template

View the template here CVE-2022-24124.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2022/CVE-2022-24124.yaml
Copy

References:

https://github.com/cckuailong/reapoc/tree/main/2022/CVE-2022-24124/vultarget
https://www.exploit-db.com/exploits/50792
https://nvd.nist.gov/vuln/detail/CVE-2022-24124
https://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html
https://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1