CVE-2024-54761
MEDIUMBigAnt Office Messenger 5.6.06 - SQL Injection via dev_code Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2024-54761. PoCs published by Nicat Abbasov, nscan9.
AI-analyzed exploit summary This exploit leverages a SQL injection vulnerability in BigAnt Office Messenger 5.6.06 to upload a PHP webshell, enabling remote command execution. It includes authentication, token handling, and a shell interface for post-exploitation.
Description
BigAnt Office Messenger 5.6.06 is vulnerable to SQL Injection via the 'dev_code' parameter.
Exploits (2)
This exploit leverages a SQL injection vulnerability in BigAnt Office Messenger 5.6.06 to upload a PHP webshell, enabling remote command execution. It includes authentication, token handling, and a shell interface for post-exploitation.
This PoC exploits a SQL injection vulnerability in BigAnt Office Messenger 5.6.06 to achieve remote code execution by uploading a PHP webshell. The exploit authenticates with default credentials, injects a malicious SQL payload to write a shell, and provides interactive command execution.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L