ghauri

Like Ghauri, consider supporting the developer Ghauri An advanced cross-platform tool that automates the process of detecting and exploiting SQL injection security flaws. Requirements Python 3 Python pip3 Installation cd to ghauri directory. install requirements: python3 -m pip install --upgrade ...

CVE-2022-31061

CVE-2022-31061 GLPI CVE-2022-31061에 대한 PoC 개념 증명 GLPI = 9.3.0 및 10.0.2에 대한 개념 증명 - 로그인 페이지에서의 인증되지 않은 SQL 인젝션 법적 고지 : 상호 동의 없이 이 스크립트를 사용하여 대상을 공격하는 것은 불법입니다. 최종 사용자는 자신의 위치에서 적용 가능한 모든 법률을 준수할 책임이 있습니다. 개발자는 어떠한 책임도 지지 않으며, 이 프로그램으로 인한 오용이나 손해에 대해 책임을 지지 않습니다. 컨텍스트 : 공개 공개 :...

CVE-2024-51482-ZoneMinder-CCTV-HTB-Reliable-EXP

README Hackthebox 머신: CCTV 애플리케이션: ZoneMinder 설명 동일한 문자에 대해 여러 번 시간 기반 블라인드 인젝션을 수행하고 가장 빈번한 결과를 선택하면 오류가 크게 줄어들고 신뢰성이 향상되지만, 시간이 많이 소요됩니다...

CVE-2019-10708

Scms - SQL Injection exploit.py는 CVE-2019-10708 취약점에 대한 PoC로, multiprocessing을 이용해 인젝션을 수행하여 데이터베이스 이름과 백엔드 관리자 계정/비밀번호를 획득합니다20190401 이전 버전 권장. 사용법 測試是否可注入 python3 exploit.py http:localhost/js/scms.php --test sleep時間為60秒與取得資料庫 python3 exploit.py http:localhost/js/scms.php -s 60 --db 取得Alogin與Apw...

CVE-2026-63030-CVE-2026-60137-wp2shell-poc

wp2shell — WordPress REST API 시간 기반 블라인드 SQLi → RCE 개념 증명PoC 설명 pocwptot.py는 WordPress REST API 배치 엔드포인트의 시간 기반 블라인드 SQL 인젝션 취약점을 악용하여, 권한 상승 체인을 거쳐 Remote Code ExecutionRCE까지 도달하는 개념 증명PoC입니다. 테스트 대상 취약점: CVE-2026-63030 CVE-2026-60137 중요 경고 본 도구는 소유한 시스템 또는 명시적인 서면 테스트 승인을 받은 시스템에서만 사용하십시오. 오용 시...

TimeInjector

TimeInjector Time injector는 bash로 작성된 CVE-2018-14714 익스플로잇 스크립트입니다. 타겟이 취약한지 확인하기 위해, 스크립트는 먼저 타겟에 접근 가능한지와 로그인 세션을 설정할 수 있는지 확인합니다. 그 후, 특정 페이지의 존재를 확인하고 시간 기반 인젝션을 수행하여 시스템이 원격 코드 실행RCE에 취약한지 확인합니다. 시스템이 명령어예: sleep 3를 실행할 때 느리게 응답하면, 타겟이 취약할 수 있음을 나타냅니다. 이는 서버가 주입된 명령어를 처리하는 데 더 많은 시간이 소요되기...

CVE-2026-96673

Versions of Photoview prior to 2.4.0 are vulnerable to an SQL injection flaw within the album download route. The root cause is the improper handling of the album_id path segment, which allows unauthenticated attackers to inject crafted SQL expressions. Successful exploitation enables attackers t...

CVE-2026-96673 Photoview through 2.4.0 SQL Injection via album download route

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the albumid path segment. Attackers can supply crafted SQL expressions in the albumid parameter to extract arbitrary data from the databa...

EUVD-2026-85345

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the albumid path segment. Attackers can supply crafted SQL expressions in the albumid parameter to extract arbitrary data from the databa...

CVE-2026-96673: Improper Neutralization of Special Elements used in an SQL Command

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the albumid path segment. Attackers can supply crafted SQL expressions in the albumid parameter to extract arbitrary data from the databa...

Astra Linux – Vulnerability in Zabbix

The Zabbix server can execute commands for configured scripts. After the command is executed, an audit entry is added to the “Audit Log”. Since the “clientip” field is not sanitized, it is possible to inject SQL code into the “clientip” field, resulting in time-based blind SQL injection attacks...

CVE-2026-72608 Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools = labelcreator permission to execute arbitrary SQL via the imagename field of a patron card layout. The imagename value is stored verbatim in the layout XML an...

CVE-2026-71287

Cacti's sanitizesqlcolumn lib/functions.php sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits, underscore, parentheses, and dot intended to support expressions like COUNTid and table.column, a payload such as passes through completely...

CVE-2026-71288 Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.pl

Koha's guided report builder reports/guidedreports.pl reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders,...

CVE-2026-71287

Cacti CVE-2026-71287 involves a flaw in sanitize_sql_column() in lib/functions.php. The function filters ORDER BY column names with preg_replace('/[^a-zA-Z0-9_().]/', '', $column), which leaves letters, digits, underscore, parentheses, and dot. This allows payloads like SLEEP(5) to pass unmodifie...

CVE-2026-15360 Ajax Load More < 8.0.1 - Unauthenticated SQL Injection via custom_args

The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database...

📄 LiteLLM 1.83.6 Blind SQL Injection

A proof of concept exploit for a pre-authentication blind SQL injection vulnerability in LiteLLM version 1.83.6. The vulnerability affects LiteLLM proxy versions 1.81.16 through 1.83.6 and occurs because the virtual-key lookup interpolates an unauthenticated bearer token directly into a PostgreSQ...

CVE-2026-15018

The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-15018 Database Collation Fix <= 1.2.10 - Unauthenticated SQL Injection via 'force-collation-algorithm' Parameter

The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

PT-2026-65700

A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable...