CVE-2023-30625 PoC — rudder-server SQL注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30625.yaml

Associated Vulnerability

Title:rudder-server SQL注入漏洞 (CVE-2023-30625)
Description:rudder-server是RudderStack开源的一个专注于隐私和安全的细分市场替代方案。 rudder-server 1.3.0-rc.1之前版本存在SQL注入漏洞，该漏洞源于PostgresSQL中的rudder角色默认具有超级用户权限，会导致远程代码执行 (RCE)。

Description

Rudder-server is part of RudderStack, an open source Customer Data Platform (CDP). Versions of rudder-server prior to 1.3.0-rc.1 are vulnerable to SQL injection. This issue may lead to Remote Code Execution (RCE) due to the `rudder` role in PostgresSQL having superuser permissions by default. Version 1.3.0-rc.1 contains patches for this issue.

File Snapshot


 id: CVE-2023-30625

info:
  name: Rudder Server < 1.3.0-rc.1  - SQL Injection
  author: gy741
  seve

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!