Summar Employee Portal 3.98.0 - Authenticated SQL Injection

ExploitDBExploitDB exploitScannerEDB-52462

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact provides a sqlmap command and a sample HTTP POST request to test for an authenticated SQL injection vulnerability in Summar Employee Portal 3.98.0. It does not contain any custom exploit code, payloads, or scripts; it only demonstrates how to use the existing sqlmap tool to scan for the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a text file containing a publicly known CVE description and a sample HTTP POST request demonstrating an authenticated SQL injection vulnerability in Summar Employee Portal. The file includes a sqlmap command line and a request body with a marked injection point. No hidden commands, obfuscated payloads, or actions beyond the described exploit are present. The file does not contain any executable code, and the review is limited to the supplied text.

ClassificationScanner
Model confidence95%
AuthenticationRequired
Languagestext
Target softwareSummar Employee Portal
Attack typesSQL Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact only provides a command to run the sqlmap scanner and a sample request file. It does not include any custom exploit code, payloads, or scripts to directly exploit the vulnerability. The description explicitly states it is a 'sqlmap' command, which is a well-known SQL injection detection and exploitation tool, but the artifact itself only demonstrates how to scan.

exploits/multiple/webapps/52462.txt:12

Requirements

  • Requires authenticated session (valid cookies) to access the vulnerable endpoint.exploits/multiple/webapps/52462.txt:16
  • Requires sqlmap tool to be installed.exploits/multiple/webapps/52462.txt:12

Observed behavior

  • The artifact provides a sqlmap command line that uses a request file to scan the 'ctl00$ContentPlaceHolder1$filtroNombre' parameter for SQL injection.exploits/multiple/webapps/52462.txt:12
  • The artifact provides a sample HTTP POST request targeting /MemberPages/quienesquien.aspx with a placeholder for the SQL injection point.exploits/multiple/webapps/52462.txt:14-31
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Usage
sqlmap command line targeting parameter 'ctl00$ContentPlaceHolder1$filtroNombre'The file provides a sqlmap command and a sample HTTP POST request to exploit an authenticated SQL injection vulnerability, consistent with the described CVE.exploits/multiple/webapps/52462.txt:12exploits/multiple/webapps/52462.txt:14-31
Vulnerability Parameter
ctl00$ContentPlaceHolder1$filtroNombreThe parameter marked as the SQL injection point in the POST request body.exploits/multiple/webapps/52462.txt:31
Review boundaries

What the analysis did not establish

  • The request file 'req.sqli.xml' referenced in the sqlmap command is not included in the evidence.
  • The artifact does not contain any custom exploit code or payloads; it only provides a command to use an external tool.
  • Review is based solely on the supplied text file; no external resources, linked tools, or the target application were analyzed.
  • The file references a sqlmap command and a request file (req.sqli.xml) that are not included in the evidence; their contents are unknown.
  • The HTTP request contains redacted Host and Cookie values, and truncated VIEWSTATE parameters, which may obscure additional context.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1