CVE-2022-24124 PoC — Casdoor SQL注入漏洞

Source

https://github.com/ColdFusionX/CVE-2022-24124

Associated Vulnerability

Title:Casdoor SQL注入漏洞 (CVE-2022-24124)
Description:The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.

Description

POC for CVE-2022-24124

Readme

# POC for CVE-2022-24124

> Exploit Code for [CVE-2022-24124](https://nvd.nist.gov/vuln/detail/CVE-2022-24124) aka Casdoor SQL Injection

Exploit Links: [[ExploitDB-50792](https://www.exploit-db.com/exploits/50792)] [[PacketStormSecurity](https://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html)]

Expected outcome: Dump SQL database version on host running Casdoor < 1.13.1

Intended only for educational and testing in corporate environments.

### Exploit Usage

```shell
Barricade➜ go run exploit.go -u http://127.0.0.1:8080

-=Casdoor SQL Injection (CVE-2022-24124)=-
- by Mayank Deshmukh (ColdFusionX)

[*] Dumping Database Version
XPATH syntax error: .12-MariaDB-0+deb11u1
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!