CVE-2014-5383

This exploit demonstrates an authenticated SQL injection vulnerability in AlienVault OSSIM 4.6.1 and below, allowing arbitrary file reads via the 'insertafter' parameter in newpolicyform.php. The Metasploit module automates the attack by leveraging SQLi to extract file contents in chunks.

This Metasploit module exploits an authenticated SQL injection vulnerability in AlienVault 4.6.1 and below via the 'insertinto' parameter in newpolicyform.php to read arbitrary files from the filesystem. It uses a time-based blind SQL injection technique to extract file contents in hexadecimal chunks.