CVE-2021-43650
CRITICALWebRun 3.6.0.42 - SQL Injection via P_0 Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2021-43650. PoCs published by Vinicius Alves, OpenXP-Research.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in Webrun 3.6.0.42 via the P_0 parameter during login. The payload manipulates the input to trigger an error message containing a specific string ('qvvxq1qbzbq'), confirming successful exploitation.
Description
WebRun 3.6.0.42 is vulnerable to SQL Injection via the P_0 parameter used to set the username during the login process.
Exploits (2)
This exploit demonstrates a SQL injection vulnerability in Webrun 3.6.0.42 via the P_0 parameter during login. The payload manipulates the input to trigger an error message containing a specific string ('qvvxq1qbzbq'), confirming successful exploitation.
This repository contains a proof-of-concept for CVE-2021-43650, demonstrating a SQL Injection vulnerability in Webrun <= 3.6.0.42. The exploit targets the login process by injecting a payload into the POST parameter P_1, resulting in a PostgreSQL error that confirms the vulnerability.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H