CVE-2023-27742 PoC — IDURAR ERP/CRM SQL注入漏洞

Source

Associated Vulnerability

Description

IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login.

Readme

# CVE-2023-27742
IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login.

# Description
> IDURAR ERP/CRM v1 was discovered to contain a SQL injection
> vulnerability via the component /api/login.
>
> ------------------------------------------
>
# Vulnerability Type
> SQL Injection
>
> ------------------------------------------
>
# Vendor of Product
> IDURAR ERP/CRM v1
>
> ------------------------------------------
>
# Affected Product Code Base
> https://github.com/idurar/erp-crm - version 1
>
> ------------------------------------------
>
# Attack Type
> Remote
>
> ------------------------------------------
>
# Impact Escalation of Privileges
> true
>
> ------------------------------------------
>
# Attack Vectors
> Use the expression {"$ne":null} in the email keypair in the /api/login request
>
> ------------------------------------------
# Discoverer 
> Soummya Mukhopadhyay @G37SYS73M

File Snapshot

 [4.0K]  /data/pocs/8865e998be72f9e88dda9689fe2a36142bdc9816
├── [ 827]  POC.md
└── [ 949]  README.md

0 directories, 2 files

Remarks