Exploit for Code Injection in Sqlpad

githubexploit · 2024-09-09

Description

SQLpad template engine exploit educational code

Entry point

Parameterpayload · request body

Path/api/test-connection

SQLPad RCE via template injection in the vulnerable /api/test-connection endpoint

Affected Sqlpad versions

Sqlpad< 6.10.1

All known vulnerabilities by product

CVSS 9.1 for CVE-2022-0944

9.1

HIGH SEVERITY

Version 3.0

VectorCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:HIGH

User Interaction:NONE

Scope:CHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Working code

100%confidence this exploit runs

Based on 2 file(s) in the source

EPSS Score

8.7%higher than 94.4% of all CVEs

Updated 2026-06-16

Exploit Details

Modified:2024-09-10 17:01

Last Seen:2025-08-31 22:16

Reporter:Philip-Otter

Written in:Python

Last commit:2024-09-10

Tags

exploitimproper neutralizationtemplate engine

Other exploits for CVE-2022-0944

SQLPad-RCE-Exploit-CVE-2022-0944

2026-08-28 KitPloitKITPLOIT

2026-08-28 KitPloitKITPLOIT

2026-08-28 KitPloitKITPLOIT

CVE-2022-0944_RCE_Automation

2026-08-28 KitPloitKITPLOIT

OverlayFS-PrivEsc-CVE-2022-0944

2026-08-28 KitPloitKITPLOIT

2026-08-27 KitPloitKITPLOIT

CVE-2022-0944_RCE_POC

2026-08-26 KitPloitKITPLOIT

OverlayFS-PrivEsc-CVE-2022-0944

2026-08-26 KitPloitKITPLOIT

Exploit Code

README4 lines

## https://sploitus.com/exploit?id=83E1B099-7BD0-5B5C-A110-B2F35F91CD98
I am not the researcher who found the exploit just the author of this code.

This code is intended for educational purposes only.