CVE-2024-54761

MEDIUM

BigAnt Office Messenger 5.6.06 - SQL Injection

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-54761 has a selected CVSS score of 6.3 (medium); EIP currently links 1 catalogued exploit and 1 repository PoC.

Description

BigAnt Office Messenger 5.6.06 is vulnerable to SQL Injection via the 'dev_code' parameter.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 10, 2025 · Source: CVE List

Proofs of concept

2

Catalogued exploits

ExploitDBBigAnt Office Messenger 5.6.06 - SQL InjectionExploitDB exploitby Nicat AbbasovExploit1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that authenticates to BigAnt Office Messenger 5.6.06, then exploits a SQL injection in the 'dev_code' parameter to write a PHP webshell to the server's web root, providing interactive command execution.

Backdoor review

No backdoor observed in reviewed code

The Python script is a straightforward SQL injection exploit that authenticates to a BigAnt Office Messenger instance, then uses a SQLi payload to write a PHP webshell to a predictable path. All behavior is consistent with the stated exploit purpose. No concealed, deceptive, or operator-directed harm beyond the declared exploit is present.

ClassificationExploit
Model confidence98%
AuthenticationRequired
Languagespython
Target softwareBigAnt Office Messenger
Attack typessql injectionremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits CVE-2024-54761 by authenticating, injecting a SQL payload to write a webshell, and then executing arbitrary OS commands via that shell. This goes beyond detection or scanning; it performs the full exploit chain to achieve remote code execution.

exploits/multiple/webapps/52412.py:108exploits/multiple/webapps/52412.py:125-127

Requirements

  • Valid credentials for the target BigAnt Office Messenger instance (default admin/123456).exploits/multiple/webapps/52412.py:16
  • Target server must be running BigAnt Office Messenger 5.6.06 with the vulnerable endpoint accessible.exploits/multiple/webapps/52412.py:1

Observed behavior

  • Authenticates to the target application using provided credentials and session tokens extracted from the login page.exploits/multiple/webapps/52412.py:38-93
  • Sends a crafted SQL injection payload via the 'dev_code' parameter to write a PHP webshell to a hardcoded server path.exploits/multiple/webapps/52412.py:106-116
  • Provides an interactive shell loop that sends commands to the uploaded webshell and prints the response.exploits/multiple/webapps/52412.py:118-131
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Webshell Upload
Payload withheldThe exploit writes a PHP webshell via SQLi INTO OUTFILE, which is the declared RCE mechanism.exploits/multiple/webapps/52412.py:108
Interactive Shell
Payload withheldThe script provides an interactive command execution interface after successful exploitation, consistent with the exploit's purpose.exploits/multiple/webapps/52412.py:118-131
Review boundaries

What the analysis did not establish

  • Only the Python exploit script was provided; no external dependencies (e.g., requests, bs4) or target environment were included or analyzed.
  • The script's effectiveness depends on the target's filesystem permissions and MySQL configuration allowing INTO OUTFILE, which is not verified by the evidence.
  • Only the supplied Python script was reviewed; external dependencies (requests, bs4) and the target application are not analyzed.
  • The script's behavior depends on the target's configuration and the presence of the SQL injection vulnerability, which are not verified here.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Repository PoCs

GitHubnscan9/CVE-2024-54761Repository PoCby nscan91Not analyzed2 files

7.5 KiB

GitHub
PoC details

References

3