The exploit demonstrates SQL injection vulnerabilities in Surreal ToDo 0.6.1.2 via two endpoints: `ajax.php` (parameter `page_id`) and the search functionality. The PoC includes HTTP requests with crafted SQL payloads that manipulate the query logic.
Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target:Surreal ToDo 0.6.1.2
No auth needed
Prerequisites:Access to the target web application