CVE-2019-13292

This exploit demonstrates a blind SQL injection vulnerability in WebERP 4.15 by leveraging insecure deserialization of base64-encoded payloads passed to the `unserialize()` function. The payload is injected into the `PaidArray` parameter, confirming the vulnerability via a time-based delay.

This repository contains a functional Python exploit for CVE-2019-13292, a blind SQL injection vulnerability in WebERP 4.15. The exploit leverages base64-encoded serialized data passed to the unserialize() function, which is then used in SQL queries without sanitization.

This repository contains a functional Python exploit for CVE-2019-13292, a blind SQL injection vulnerability in WebERP 4.15. The exploit leverages base64-encoded serialized data passed to the unserialize() function, which is then used in SQL queries without sanitization.

This repository contains a functional Python exploit for CVE-2019-13292, a blind SQL injection vulnerability in WebERP 4.15. The exploit leverages base64-encoded serialized payloads to inject malicious SQL queries via the 'Payments.php' endpoint, confirming vulnerability via time-based delays.