CVE-2019-9053

CVE 2019-9053 Detail Description This code is an implementation of a Time-Based Blind SQL Injection attack in Python 3. The attack is designed to exploit a SQL injection vulnerability in a Content Management System CMS Made Simple 2.2.8 through an HTTP request. Exploit Use: root@kitploit:...

Jeeves

Jeeves Usage • Installation Jeeves is made for looking to Time-Based Blind SQLInjection through recon. Contents: Installation Usage Adding Headers Using Proxy Making Post Request Multiple ways of usage - Installation & Requirements: Installing Jeeves 💀 root@kitploit: $ go install...

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

CVE-2025-4396

CVE-2025-4396 — Relevanssi SQL-инъекция Time-Based Blind Отказ от ответственности: Этот репозиторий предназначен только для авторизованного тестирования на проникновение, исследований в области безопасности и образовательных целей. Несанкционированный доступ к компьютерным системам незаконен и...

CVE-2024-51482-POC

ZoneMinder Authenticated Time Based SQLi POC - CVE-2024-51482 ⚠️ For educational and authorized security research only. Running this tool against systems you do not own or lack written permission to test is illegal. Table of Contents ZoneMinder Authenticated Time Based SQLi POC - CVE-2024-51482...

CVE-2024-37843-POC

CVE-2024-37843-POC POC for CVE-2024-37843. Craft CMS time-based blind SQLi Details available in blog POC root@kitploit: curl -X POST '/api/' -H 'Content-Type:application/json' -d '"query":"query IntrospectionQuery assetsorderBy: "assets.volumeId -- \\ \n \n LIMIT 5 AS subquery\nINNER JOIN...

CVE-2025-45809-PoC

CVE-2025-45809 — SQL-инъекция в LiteLLM через /key/block Time-Based Blind SQLi LiteLLM v1.65.4 версии до v1.81.0 — в параметре key конечных точек /key/block и /key/unblock присутствует уязвимость SQL-инъекции. Злоумышленник может использовать технику time-based blind injection для кражи содержимо...

CVE-2024-35584

CVE-2024-35584 OpenSIS 인증된 SQL 인젝션 설명 Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php에 SQL 인젝션 취약점이 존재합니다. 이 취약점은 OpenSis Community Edition 9.18.0 및 그 이하 버전에 영향을 미칩니다. 개념 증명 예시 중 하나인 Ajax.php에서는 악의적인 활동이 발생하면 IP가 로그로 기록되어 데이터베이스에 삽입될 수 있음을 확인할 수 있습니다. 주의할 점은...

CVE-2024-37791

CVE-2024-37791 CVE-2024-37791 Project address: Preparatory work: Log in to the backend - get cookie Vulnerability URL: http://127.0.0.1:8093/s/article/Content/index?classid=&keyword= Vulnerability parameter: keyword payload: %27andselectfromselect+ifasciisubstrdatabase,1,1%3E97,sleep1,0a//union/...

CVE-2025-28346

Vulnerability Type SQL Injection Description A Time-Based Blind SQL Injection vulnerability was discovered in Ticket-Booking-App - 1.0 that allows an attacker to execute arbitrary SQL queries on the underlying database. The vulnerable parameter does not properly sanitize user-supplied input,...

CVE-2024-27956

CVE-2024-27956 Примечание Сборка WordPress: docker-compose -f stack.yml up Установка плагина: 1. В панели управления WordPress выберите Плагины Добавить новый 2. Нажмите «Загрузить плагин» 3. Выберите файл - wp-automatic.zip - «Установить» 4. После завершения установки нажмите «Активировать плаги...

CVE-2024-51482-PoC

CVE-2024-51482-PoC Эксплойт аутентифицированной time-based blind SQL-инъекции для ZoneMinder v1.37. = 1.37.64 Обзор Это proof-of-concept эксплойт для CVE-2024-51482, уязвимости time-based blind SQL-инъекции в функциональности управления событиями ZoneMinder. Эксплойт требует аутентификации и...

WordPress-NotificationX-CVE-2024-1698

Настройка root@kitploit: docker-compose up --build Очистка root@kitploit: docker-compose down Тестирование root@kitploit: Measure-Command curl.exe http://localhost/wp-json/notificationx/v1/analytics -Method Post -Body 'nxid=1337&type=clicks=IFASCIISUBSTRINGselect userpass from wpusers where...

Geo Mashup <= 1.13.18 - SQL Injection

Geo Mashup WordPress plugin = 1.13.18 is vulnerable to time-based SQL injection via the sort parameter. The issue exists because the sort value is insufficiently sanitized in render-map.php/template tag code paths. id: CVE-2026-4060 info: name: Geo Mashup = 1.13.18 - SQL Injection author:...

phpMyFAQ <= 4.1.1 - SQL Injection

phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector and BuiltinCaptcha::saveCaptcha methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captc...

Spam protection, AntiSpam, FireWall by CleanTalk < 5.153.4 - Unauthenticated Blind SQL Injection

It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The updatelog function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected v...

CVE-2021-41651

CVE-2021-41651 CVE-2021-41651 SQL-инъекция в hotel-mgmt-system hotel-mgmt-system уязвим для неаутентифицированной атаки time-based blind SQL-инъекции. Параметр cid на странице /processupdateprofile.php не санирует пользовательский ввод, что позволяет злоумышленнику извлекать конфиденциальные данн...

CVE-2023-38890

CVE-2023-38890 Description Online Shopping Portal Project V3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in t...

CMS-Made-Simple-2.2.9-Unauthenticated-SQL-Injection-Exploit-CVE-2019-9053-

CMS Made Simple = 2.2.9 SQL Injection Exploit CVE-2019-9053 📌 Description This exploit targets an unauthenticated SQL injection vulnerability in CMS Made Simple = 2.2.9 CVE-2019-9053. The vulnerability allows attackers to extract sensitive information such as username, email, password hash, and...

CVE-2026-14762-PoC-Exploit

CVE-2026-14762 – Эксплуатация SQL-инъекции в Code‑Projects Hotel & Tourism Reservation 1.0 -orange -red Полнофункциональный, многопоточный эксплуатационный скрипт для слепой SQL-инъекции на основе времени для CVE‑2026‑14762. Нацелен на конечную точку /admin/rooms.php приложения Code‑Projects Hote...