Exploitation Summary
EIP tracks 2 public exploits for CVE-2024-44541. PoCs published by pointedsec.
AI-analyzed exploit summary This exploit demonstrates an error-based SQL injection in Inventio Lite 4's login process, extracting administrator credentials via blind SQLi and decrypting the password hash using a dictionary attack.
Description
evilnapsis Inventio Lite Versions v4 and before is vulnerable to SQL Injection via the "username" parameter in "/?action=processlogin."
Exploits (2)
This exploit demonstrates an error-based SQL injection in Inventio Lite 4's login process, extracting administrator credentials via blind SQLi and decrypting the password hash using a dictionary attack.
This repository contains a functional SQL injection exploit for CVE-2024-44541 in Inventio Lite v4, targeting the `/action=processlogin` endpoint via the `username` parameter. The Python script automates authentication bypass and data extraction, including administrator credentials.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H