mssqlproxy

mssqlproxy mssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse. The client requires impacket and sysadmin privileges on the SQL server. Please read this article carefully before continuing. It consists of...

MSSQLand

✈️ MSSQLand Land gracefully in your target Microsoft SQL Server MS SQL DBMS, as if arriving on a business-class flight with a champagne glass in hand. 🥂 MSSQLand is a C Microsoft SQL Server MSSQL / MS SQL post-exploitation tool built for red team operators. Designed to run inside the target...

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

legba

legba Join the project community on our server! Legba is a multiprotocol credentials bruteforcer / password sprayer and enumerator built with Rust and the Tokio asynchronous runtime in order to achieve better performances and stability while consuming less resources than similar tools. Key Featur...

msdat

Quentin HARDY --- [email protected] [email protected] MSDAT MSDATM icros oft SQL D atabase A ttacking T ool은 원격으로 Microsoft SQL 데이터베이스의 보안을 테스트하는 오픈 소스 침투 테스트 도구입니다. MSDAT 사용 예시: 원격으로 Microsoft 데이터베이스가 수신 대기 중이며, 데이터베이스에 연결하기 위한 유효한 자격 증명을 찾고 싶을 때 유효한 Microsoft SQL 계정이 있으며, 권한을 상승시키고 싶을...

msdat

Quentin HARDY --- [email protected] [email protected] MSDAT MSDAT M icros oft SQL D atabase A ttacking T ool is an open source penetration testing tool that tests the security of Microsoft SQL Databases remotely. Usage examples of MSDAT: You have a Microsoft database listening remotely...

CVE-2008-5416

CVE-2008-5416 Microsoft SQL Server spreplwritetovarbin 메모리 손상 SQL Injection을 통한 문서화되지 않은 확장 저장 프로시저 "spreplwritetovarbin"을 호출할 때 힙 기반 버퍼 오버플로가 발생할 수 있습니다. 이 취약점은 MS09-004에서 제공된 업데이트가 적용되지 않은 모든 버전의 Microsoft SQL Server 2000 및 2005, Windows Internal Database, Microsoft Desktop Engine MSDE에 영향을 미칩니...

cve-2024-50330-ivanti_epm_sqli_reproduction

CVE-2024-50330: Ivanti Endpoint Manager EPM SQL 인젝션을 통한 RCE 개요 CVE-2024-50330은 Ivanti Endpoint Manager EPM의 치명적인 인증 전 SQL 인젝션 취약점으로, 원격의 인증되지 않은 공격자가 대상 서버에서 원격 코드 실행을 달성할 수 있게 합니다. 이 취약점은 2024년 11월 보안 업데이트에서 공개 및 패치되었습니다. 기술적 세부 사항 CVE : CVE-2024-50330 CWE : CWE-89 SQL 인젝션 CVSS : 치명적 CVSS 3.x 점수...

CVE-2019-1068

CVE-2019-1068 “svl.dll” 리버싱을 통한 Microsoft SQL Server 스택 오버플로 취약점에 대한 근본 원인 분석 및 PoC. 관련 작업 링크: 1. Ataberk의 블로그 2. Fatih의 블로그 3. Cem의 블로그 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1068...

CVE-2026-18782-TREX-MES-Uygulamalarinda-SQL-Zafiyeti

TREX-MESアプリケーションにおけるSQLi脆弱性（CVE-2026-18782） 概要 TREX MESは、製造現場からデータを収集・管理するために使用される商用の製造実行システム（MES）/ Industry 4.0プラットフォームです。アプリケーションのWeb APIは、クライアントから送信されたsql パラメータをバックエンドのMicrosoft SQL Server上で直接実行し、結果セットをJSONとして返します。 影響 低権限の認証済みユーザー — または以下に説明する認証回避によってセッショントークンを取得した任意の攻撃者 — は、次のことが可能です： SQL...

CVE-2025-24999

CVE-2025-24999 CVE-2025-24999에 대한 개념 증명 https://databasesecurityninja.wordpress.com/2026/04/02/microsoft-sql-server-privilege-elevation-through-msdatabasemanager-role-cve-2025-24999/...

CVE-2023-54400

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...

EUVD-2023-60696

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...

CVE-2023-54400 Fumeng Cloud SQL Injection via AjaxMethod.ashx getEmpByname

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...

CVE-2023-54400

Fumasoft Fumeng Cloud is vulnerable to a SQL injection flaw in the AjaxMethod.ashx endpoint. Specifically, the getEmpByname action fails to properly sanitize the Name parameter, allowing unauthenticated remote attackers to execute arbitrary SQL commands against the Microsoft SQL Server backend. E...

CVE-2023-54400 Fumeng Cloud SQL Injection via AjaxMethod.ashx getEmpByname

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...

VulnCheck KEV: CVE-2023-54400

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...

CVE-2026-92237

Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obtain application tokens, data protection key material and other stored credentials via SQL paramet...

CVE-2024-58385

Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to...

CVE-2024-58385 Yonyou U8 CRM SQL Injection via fillbacksettingedit.php

Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to...