Casdoor CVE-2022-24124 SQL注入漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-24124
• https://github.com/casdoor/casdoor/issues/439
• https://github.com/casdoor/casdoor/pull/442
• https://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1
• https://github.com/advisories/GHSA-m358-g4rp-533r
• https://github.com/ColdFusionX/CVE-2022-24124
• https://www.exploit-db.com/exploits/50792
• https://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html
• https://blog.qualys.com/vulnerabilities-threat-research/2022/03/09/casdoor-sql-injection-cve-2022-24124
• https://www.sentinelone.com/vulnerability-database/cve-2022-24124/

Related Vulnerabilities

• Casdoor /conf/app.conf 信息泄露漏洞（CVE-2024-5587）
• PoCcasdoor-default-login: Casdoor - Default Admin Credentials
• Casdoor /api/login 默认口令漏洞
• PoCCVE-2025-4210: Casdoor - Authorization Bypass
• PoCCVE-2022-24124: Casdoor 1.13.0 - Unauthenticated SQL Injection
• PoCcasdoor-static-fileread: Casdoor 任意文件读取漏洞
• PoCcasdoor-unauth-operations: Casdoor <=v1.811.0 - Unauthenticated SCIM Operations
• PoCcasdoor-users-password: Casdoor get-users Account Password Disclosure
• Casdoor /static 文件读取漏洞
• Casbin casdoor static 任意文件读取漏洞
• Casdoor系统存在信息泄露