CVE-2022-23046 - SQL Injection Vulnerability on PhpIPAM v1.4.4

Last update: Feb 15, 2022

Overview

CVE-2022-23046

PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php.

Installation

Build

git clone https://github.com/dnr6419/CVE-2022-23046.git
cd CVE-2022-23046 && docker-compose up -d 
pip3(or pip) install -r requirements.txt
python3(or python) CVE-2022-23046.py -h

Setup 2-1. Go to the http://[YOUR_IP] and Choose [New phpipam installation].

2-2. Choose [Automatic database installation].
2-3. MySQL username & Password is "root"/"my_secret_mysql_root_pass".

2-4. Setting the Password and Login to check the installation is complete.

Exploit

  python3 CVE-2022-23046.py --url http://localhost --user admin
  # and input your password

Reference

https://github.com/jcarabantes/CVE-2022-23046.git
https://hub.docker.com/r/phpipam/phpipam-www

Owner

GitHub Repository

On-demand scanning for container registries

Lacework registry scanner Install & configure Lacework CLI Integrate a Container Registry Go to Lacework Resources Containers Container Image In

1 Dec 14, 2021

Exploit grafana Pre-Auth LFI

Grafana-LFI-8.x Exploit grafana Pre-Auth LFI How to use python3

2 Jul 25, 2022

Fuck - Multi Brute Force 🚶‍♂

f-mbf Fuck - Multi Brute Force 🚶‍♂ Install Script $ pkg update && pkg upgrade $ pkg install python2 $ pkg install git $ pip2 install requests $ pip2

1 Dec 03, 2021

KeyKatcher is a keylogger that records keystrokes made on a computer and sends to the E-Mail.

What is a keylogger? A keylogger is a software application or piece of hardware that monitors and records keystrokes made on a computer keyboard. The

7 Sep 19, 2022

To explore creating an application that detects available connections at once from wifi and bluetooth

Signalum A Linux Package to detect and analyze existing connections from wifi and bluetooth. Also checkout the Desktop Application. Signalum Installat

56 Mar 03, 2021

This Repository is an up-to-date version of Harvard nlp's Legacy code and a Refactoring of the jupyter notebook version as a shell script version.

17 Sep 25, 2022

Cobalt Strike < 4.4 dos CVE-2021-36798

CVE-2021-36798 CVE-2021-36798 Cobalt Strike 4.3 dos 用法 python3 CVE-2021-36798.py BeaconURL 打瘫Cobalt Strike 只需要一个包已测试 4.3 4.2 参考： https://labs.sent

37 Nov 09, 2022

Lite version of my Gatekeeper backdoor for public use.

MayorSec Backdoor Fully functioning bind-type backdoor This backdoor is a fully functioning bind shell and lite version of my full functioning Gatekee

56 Mar 25, 2022

Static Token And Credential Scanner

Static Token And Credential Scanner What is it? STACS is a YARA powered static credential scanner which suports binary file formats, analysis of neste

81 Dec 27, 2022

A simple linux keylogger project.

The project This project is a simple linux keylogger. When activated, it registers all the actions made with the keyboard. The log files are registere

1 Oct 24, 2021

A Python tool to automate some dorking stuff to find information disclosures.

WebDork v1.0.3 A open-source tool to find publicly available sensitive information about Companies/Organisations! WebDork A Python tool to automate so

123 Jan 08, 2023

This is python script that will extract the functions call in all used DLL in an executable and then provide a mapping of those functions to the attack classes defined and curated malapi.io.

F2Amapper This is python script that will extract the functions call in all used DLL in an executable and then provide a mapping of those functions to

3 Sep 03, 2022

CVE-2022-23046 - SQL Injection Vulnerability on PhpIPAM v1.4.4

Related tags

Overview

CVE-2022-23046

Installation

Exploit

Reference

Owner

On-demand scanning for container registries

Exploit grafana Pre-Auth LFI

Fuck - Multi Brute Force 🚶‍♂

KeyKatcher is a keylogger that records keystrokes made on a computer and sends to the E-Mail.

To explore creating an application that detects available connections at once from wifi and bluetooth

This Repository is an up-to-date version of Harvard nlp's Legacy code and a Refactoring of the jupyter notebook version as a shell script version.

Cobalt Strike < 4.4 dos CVE-2021-36798

Lite version of my Gatekeeper backdoor for public use.

Static Token And Credential Scanner

A simple linux keylogger project.

A Python tool to automate some dorking stuff to find information disclosures.

This is python script that will extract the functions call in all used DLL in an executable and then provide a mapping of those functions to the attack classes defined and curated malapi.io.

Log4j vuln fuzz/scan with python

Vulnerability Exploitation Code Collection Repository

Discord-email-spammer-exploit - A discord email spammer exploit with python

Buff A simple BOF library I wrote under an hour to help me automate with BOF attack

Internationalized Domain Names for Python (IDNA 2008 and UTS #46)

MTBLLS Ethical Hacking Tool Announcement of v2.0

Hack any account sending fake nitro QR code (only for educational purpose)

Facebook Fast Cracking Tool With Python