CVE-2024-6670

This PoC exploits an SQL injection vulnerability in Progress Software WhatsUp Gold to bypass authentication by updating the admin password. It uses a remote primitive to encrypt the new password and then injects SQL queries to exfiltrate and set the encrypted password.

This Metasploit module exploits a SQL injection vulnerability in WhatsUp Gold to change the password of an existing user (default: admin) to an attacker-controlled one. It leverages a blind SQLi technique to extract and modify credentials.