CVE-2022-0944 PoC — Template injection in connection test endpoint leads to RCE in sqlpad/sqlpad

Source

https://github.com/FlojBoj/CVE-2022-0944

Associated Vulnerability

Title:Template injection in connection test endpoint leads to RCE in sqlpad/sqlpad (CVE-2022-0944)
Description:Template injection in connection test endpoint leads to RCE in GitHub repository sqlpad/sqlpad prior to 6.10.1.

Description

SQLPad - Template injection

Readme

# CVE-2022-0944
SQLPad - Template injection

This is a blind vulnerability, meaning that the output is directly returned in the response.

## Exploit
Use the script with the following command:  
`python3 exploit.py http://localhost:13000 <command>`

## Testing environment
Using docker:
- Start the docker container - `sudo docker run -p 13000:3000 -d --env SQLPAD_ADMIN=admin --env SQLPAD_ADMIN_PASSWORD=password --name vulnerable-sqlpad sqlpad/sqlpad:6.10.0`
- Connect to the docker container - `sudo docker exec -it sqlpad /bin/bash`

To access the web interface, use URL `http://localhost:13000` with credentials `admin:password`.

## Affected versions
<= 6.10.0

## Source
https://huntr.com/bounties/46630727-d923-4444-a421-537ecd63e7fb

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!