| 제목 | Pihome PiHomeHVAC 2.0 SQL Injection |
|---|
| 설명 | In the PiHomeHVAC v 2.0 - there is a SQLi in the ajax.php controller.
The web application is vulnerable to SQL Injection attacks within ajax modal functionality. Attackers can exploit this vulnerability by injecting malicious input into the "Ajax" parameter,
which is used to edit values in the `sensors` table. A prerequisite is that a record exists in this table
To exploit the SQL injection vulnerability, attackers craft a payload containing malicious input and inject it into the "Ajax" parameter. For example,
submitting the payload `(sleep(20))--` triggers 20 seconds delay in the request. This demonstrates the successful execution of the injection within the application. |
|---|
| 원천 | ⚠️ https://www.singto.io/pocsforexploits/pihomehva_sqli_ajax.md |
|---|
| 사용자 | Jelle Janssens (UID 81048) |
|---|
| 제출 | 2025. 02. 05. PM 07:30 (1 년도 ago) |
|---|
| 모더레이션 | 2025. 02. 10. PM 12:09 (5 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 295089 [pihome-shc PiHome 2.0 ajax.php?Ajax=GetModal_Sensor_Graph SQL 주입] |
|---|
| 포인트들 | 20 |
|---|