CVE-2023-24775 PoC — FunAdmin SQL注入漏洞

Source

https://github.com/csffs/CVE-2023-24775-and-CVE-2023-24780

Associated Vulnerability

Title:FunAdmin SQL注入漏洞 (CVE-2023-24775)
Description:FunAdmin是FunAdmin开源的一个基于 ThinkPHP6+Layui 开发的轻量级高颜值后台开发系统。 FunAdmin 3.2.0版本存在安全漏洞，该漏洞源于通过memberMember.php 中的 selectFields 参数发现包含SQL注入漏洞。

Description

my python poc CVE-2023-24774 and CVE-2023-24775 this sqli cve funadmin

Readme

# CVE-2023-24775-and-CVE-2023-24780
my python poc 2023-24780 and CVE-2023-24775 this sqli cve funadmin

This is a repository with a poc exploit for python cve sqli funadmin.

CVE-2023-24774 - https://nvd.nist.gov/vuln/detail/CVE-2023-24780

Vulnerable version of Funadmin v3.2.0 
Vulnerability via id parameter in /databases/table/columns.

and

CVE-2023-24775 - https://nvd.nist.gov/vuln/detail/CVE-2023-24775

It was found, in Funadmin v3.2.0 
This is implemented via the selectFields parameter in \member\Member.php.


run

1) python sqli_poc.py -u https://site.com
 
2) if CVE-2023-24780 enter 1, if CVE-2023-24775 enter 2
 
3) input sqli for example OR 1=1 or press entr program enters sqli for you

File Snapshot


 [4.0K]  /data/pocs/ee19e1ef7aad23a9b3f6f08ab3144b9314908f52
├── [ 704]  README.md
└── [5.7K]  sqli_poc.py

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!