Advertisement






Small CRM 3.0 Authentication Bypass SQL Injection

CVE Category Price Severity
CWE-287 $500 High
Author Risk Exploitation Type Date
Unknown High Remote 2021-06-22
CVSS EPSS EPSSP
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 0.02192 0.50148

CVSS vector description

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2021060125

Below is a copy:

Small CRM 3.0 Authentication Bypass SQL Injection
# Exploit Title: Small CRM 3.0 - 'Authentication Bypass' SQL Injection
# Date: 12/06/2021
# Exploit Author: BHAVESH KAUL
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/small-crm-php/
# Version: 3.0
# Tested on: Server: XAMPP

# Description #

Small CRM 3.0 is vulnerable to SQL Injection on it's admin login because of insufficient user supplied data sanitization and the sql injection payload being executed. Attacker is able to access the admin login panel and supply the malicious payload, successfully taking over admin account.

# Proof of Concept (PoC) : Exploit #

1) Goto: http://localhost/crm/admin/

2) Enter the following payload in 'Username' and 'Password' parameter: ' OR 'x'='x

3) SQL Injection successfull

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.