CVE-2021-43609-POC

Spiceworks Sort SQLi Spiceworks の sort パラメータに SQLi が存在します。完全なエクスプロイトチェーンは SQLi - ファイル読み取り - RCE です。 デモ 前提条件 apt update && apt install -y ruby-dev nodejs python3 python3-pip libsqlite3-dev pip3 install requests gem install bundler && cd rce && bundle install ステージ 1 poc.py を使用して SQLi -...

AOSP-DownloadProviderDbDumperSQLiLimit

AOSP-DownloadProviderDbDumperSQLiLimit AndroidのDownload ProviderのSortパラメータにおけるSQLインジェクションを悪用するPoC CVE-2019-2196 セキュリティアドバイザリ Android AOSP Download ProviderのクエリSortパラメータにおけるSQLインジェクション CVE-2019-2196 デモ...

CVE-2021-36396-Moodle-Time-Based-SQLi-Exploit

CVE-2021-36396 漏洞利用 描述 此仓库包含一个基于Python的漏洞利用脚本，针对CVE-2021-36393，这是Moodle最近课程功能中发现的一个严重漏洞。该缺陷存在于'sort'参数中，导致SQL注入攻击，可能未经授权访问数据库。CVSS评分为9.8，利用此漏洞需要最低权限（如学生角色），并严重危害数据的机密性和完整性。 受影响的版本： 3.11, 3.10 至 3.10.4, 3.9 至 3.9.7 以及更早的不受支持的版本 安装 要使用此漏洞利用工具，你需要在系统上安装Python。克隆此仓库并安装所需依赖： git clone...

Stash < 0.26.0 - SQL Injection

Stash up to v0.25.1 was discovered to contain a SQL injection vulnerability via the sort parameter. id: CVE-2024-32231 info: name: Stash Stash" tags: cve,cve2024,stash,sqli,vuln http: - raw: - | POST /graphql HTTP/1.1 Host: Hostname Content-type: application/json...

CVE-2008-4687-exploit

CVE-2008-4687-exploit CVE-2008-4687 用の手早い雑な Python エクスプロイト。 NIST による説明: Mantis 1.1.4 より前の manageprojpage.php では、リモートの認証済みユーザーが sort パラメータに PHP シーケンスを含めることで任意のコードを実行でき、これらのシーケンスは core/utilityapi.php の multisort 関数内の createfunction によって処理されます。...

CVE-2025-32429

CVE-2025-32429 XWiki SQLインジェクション PoC 著者: Byte Reaper Telegram: @ByteReaper0 CVE: CVE‑2025‑32429 脆弱性: XWiki LiveData REST API におけるブラインドSQLインジェクション 影響を受けるファイル: getdeleteddocuments.vm（sortパラメータ） 説明 XWiki PlatformのLiveData RESTエンドポイントにおいて、getdeleteddocuments.vm の sort...

CVE-2026-25746_SqlInjectionVulnerabilityOpenEMR7.0.4

CVE-2026-25746 - OpenEMR 弱点 CWE-89 未正确中和用于 SQL 命令的特殊元素（'SQL 注入'） 产品使用来自上游组件的受外部影响的输入来构建 SQL 命令的全部或部分内容，但未中和或错误地中和了在发送至下游组件时可能修改预期 SQL 命令的特殊元素。如果没有充分删除或引用用户可控输入中的 SQL 语法，生成的 SQL 查询可能会导致这些输入被解释为 SQL 而非普通用户数据。了解更多信息请访问 MITRE。 摘要 OpenEMR act$GET; Controller 的 act 方法： $args =...

CVE-2026-4060-PoC

CVE-2026-4060 — Geo Mashup ≤ 1.13.18 認証なしSQLインジェクション PoC -blue 認証なし の攻撃者は、Geo Mashup の render-map エンドポイントの sort パラメータを介して ORDER BY 句に任意のSQLを注入し、機密データベース情報の時間ベースのブラインド抽出を可能にします。 目次 Vulnerability Overview Test Environment How to Run Test Results Mitigation Detection Timeline References 脆弱性の概要 フィールド...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure in the getSortColumn process. An attacker can access sensitive database column names and manipulate the ordering of query results by supplying arbitrary values to the sort parameter, which are not validated against...

CVE-2026-78472

The Ni WooCommerce Sales Report WordPress plugin (versions before 4.2.0 ) is vulnerable to an unauthenticated SQL injection attack. The root cause is the failure to properly sanitize and escape a parameter—specifically the 'sort' parameter —before incorporating it into a SQL statement. This flaw ...

CVE-2026-78472 Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated SQLi via 'sort' Parameter

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-78472 Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated SQLi via 'sort' Parameter

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

SQL Injection

Overview org.apache.syncope.core:syncope-core-persistence-jpa is an Open Source system for managing digital identities in enterprise environments, implemented in Java EE technology and released under Apache 2.0 license. Affected versions of this package are vulnerable to SQL Injection via the sor...

CVE-2026-82232

Apache Syncope is vulnerable to an SQL injection flaw caused by the improper neutralization of special elements in SQL commands. Specifically, an administrator with adequate entitlements can execute arbitrary SQL via stacked queries by leveraging unsanitized sort clauses during a Task search . Th...

CVE-2026-82232 Apache Syncope: SQL injection via sort parameter in Task search

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort clauses for Task search. This issue affects Apach...

CVE-2026-82232 Apache Syncope: SQL injection via sort parameter in Task search

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort clauses for Task search. This issue affects Apach...

CVE-2026-79569

MovieRecommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-79569

MovieRecommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

EUVD-2026-72959

MovieRecommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

PT-2026-87143

Movie Recommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...