Nicat Abbasov

ExploitDB · Author

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

ExploitDB

BigAnt Office Messenger 5.6.06 - SQL Injection

ExploitDB exploitPublished 2025-08-18ExploitCVE-2024-547611 file

EDB-52412

ExploitDBPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that authenticates to BigAnt Office Messenger 5.6.06, then exploits a SQL injection in the 'dev_code' parameter to write a PHP webshell to the server's web root, providing interactive command execution.

Backdoor review

No backdoor observed in reviewed code

The Python script is a straightforward SQL injection exploit that authenticates to a BigAnt Office Messenger instance, then uses a SQLi payload to write a PHP webshell to a predictable path. All behavior is consistent with the stated exploit purpose. No concealed, deceptive, or operator-directed harm beyond the declared exploit is present.

ClassificationExploit
Model confidence98%
AuthenticationRequired
Languagespython
Target softwareBigAnt Office Messenger
Attack typessql injectionremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits CVE-2024-54761 by authenticating, injecting a SQL payload to write a webshell, and then executing arbitrary OS commands via that shell. This goes beyond detection or scanning; it performs the full exploit chain to achieve remote code execution.

exploits/multiple/webapps/52412.py:108exploits/multiple/webapps/52412.py:125-127

Requirements

  • Valid credentials for the target BigAnt Office Messenger instance (default admin/123456).exploits/multiple/webapps/52412.py:16
  • Target server must be running BigAnt Office Messenger 5.6.06 with the vulnerable endpoint accessible.exploits/multiple/webapps/52412.py:1

Observed behavior

  • Authenticates to the target application using provided credentials and session tokens extracted from the login page.exploits/multiple/webapps/52412.py:38-93
  • Sends a crafted SQL injection payload via the 'dev_code' parameter to write a PHP webshell to a hardcoded server path.exploits/multiple/webapps/52412.py:106-116
  • Provides an interactive shell loop that sends commands to the uploaded webshell and prints the response.exploits/multiple/webapps/52412.py:118-131
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Webshell Upload
Payload withheldThe exploit writes a PHP webshell via SQLi INTO OUTFILE, which is the declared RCE mechanism.exploits/multiple/webapps/52412.py:108
Interactive Shell
Payload withheldThe script provides an interactive command execution interface after successful exploitation, consistent with the exploit's purpose.exploits/multiple/webapps/52412.py:118-131
Review boundaries

What the analysis did not establish

  • Only the Python exploit script was provided; no external dependencies (e.g., requests, bs4) or target environment were included or analyzed.
  • The script's effectiveness depends on the target's filesystem permissions and MySQL configuration allowing INTO OUTFILE, which is not verified by the evidence.
  • Only the supplied Python script was reviewed; external dependencies (requests, bs4) and the target application are not analyzed.
  • The script's behavior depends on the target's configuration and the presence of the SQL injection vulnerability, which are not verified here.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.