CVE-2019-5893

This exploit demonstrates a SQL injection vulnerability in OpenSource ERP v6.3.1 via a crafted POST request to the `/db/utils/query/data.xml` endpoint. The payload extracts the database version by manipulating the SQL query through URL-encoded characters.

This repository contains a proof-of-concept for SQL injection in OpenSource ERP, demonstrating how to extract database name and version via crafted HTTP POST requests. The exploit leverages the `query` parameter in `/db/utils/query/data.xml` to execute arbitrary SQL queries.