CVE-2024-32369 PoC — HSC Cybersecurity HC Mailinspector 安全漏洞

Source

Associated Vulnerability

Readme

# CVE-2024-32369

**Description:** SQL Injection vulnerability in HSC Cybersecurity HSC Mailinspector v.5.2.17-3 allows a remote attacker to obtain sensitive information via a crafted payload to the start and limit parameter in the mliWhiteList.php component.

**Versions:** Discovered in HSC Mailinspector 5.2.17-3 but applicable to all versions up to 5.2.18.

## Proof of Concept

The SQL injection vulnerability occurs in the limit parameter of the application's request payload. Specifically, the payload exec=fetch&start=0&limit=30' is susceptible to SQL injection.

> Payload: `exec=fetch&start=0&limit=30'`

## Vulnerable Parameter:

- Parameter: `limit`
- Payload: `exec=fetch&start=0&limit=30'`

![alt text](image.png)

File Snapshot

 [4.0K]  /data/pocs/0d3262befcc72740ec999ae17202c99fdb6c0682
├── [107K]  image.png
└── [ 727]  README.md

0 directories, 2 files

Remarks