ordinary-hacker

Exploit Title: Silverpeas CRM - Authentication Bypass

Date of found: 12/05/2024

Exploit Author: Chris Pritchard chris@grislygrotto.nz

Version: V1.0

Tested on: 6.3.4

Fixed in: 6.3.5

Vendor Homepage: https://silverpeas.org/

Software Link: https://silverpeas.org/

CVE: CVE-2024-36042

CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36042

Must read

This is for SQL INSERT statement. For SELECT statements, please see https://gist.github.com/shriyanss/6192ee7eb80da5efc26916922fc9b035

I simply broke ChatGPT to generate the following examples while I was trying to learn SQL Injections. The following output is completely generated by ChatGPT:-

Certainly, here are examples of malicious inputs that could lead to SQL injection vulnerabilities in INSERT statements, along with the resulting queries. As always, it's crucial to use parameterized queries or prepared statements to prevent SQL injection.

Example 1: Classic SQL Injection in INSERT

Malicious Input:

x64 NASM cheat sheet

Registers

	64 bit	32 bit	16 bit	8 bit
A (accumulator)	`RAX`	`EAX`	`AX`	`AL`
B (base, addressing)	`RBX`	`EBX`	`BX`	`BL`
C (counter, iterations)	`RCX`	`ECX`	`CX`	`CL`
D (data)	`RDX`	`EDX`	`DX`	`DL`

	# SGR color constants
	# rene-d 2018

	class Colors:
	""" ANSI color codes """
	BLACK = "\033[0;30m"
	RED = "\033[0;31m"
	GREEN = "\033[0;32m"
	BROWN = "\033[0;33m"
	BLUE = "\033[0;34m"

	wampp:xampp
	webdav:webdav
	jigsaw:jigsaw