CVE-2024-5356 PoC — anji-plus AJ-Report testTransform;swagger-ui sql injection

Source

https://github.com/droyuu/Aj-Report-sql-CVE-2024-5356-POC

Associated Vulnerability

Title: anji-plus AJ-Report testTransform;swagger-ui sql injection (CVE-2024-5356)
Description:A vulnerability, which was classified as critical, was found in anji-plus AJ-Report up to 1.4.1. Affected is an unknown function of the file /dataSet/testTransform;swagger-ui. The manipulation of the argument dynSentence leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-266268.

Readme

##exp.py -u指定url或-f指定文件批量检测，-t指定线程,-h查看帮助

##使用 pi install requirements.txt python exp.py -u 目标url -t 10 python exp.py -h

#注意事项 保证url以http://或https://开头，否则会报错无法执行

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →