SQLPad 6.10.0 Exploit (CVE-2022-0944)

This Bash script exploits an RCE vulnerability in SQLPad 6.10.0, allowing an attacker to achieve remote code execution (RCE) by abusing the host and database fields in SQLPad’s MySQL database connection settings. The exploit leverages SQLPad’s unsanitized handling of the child_process module in Node.js to execute arbitrary commands, ultimately opening a reverse shell on the attacker's machine.

Prerequisites

1. Netcat Listener: Ensure you have a listener active on your machine with nc -lvnp 9001.
2. Target Server Access: This exploit assumes you can communicate with the vulnerable SQLPad instance.

Usage

1. Clone the Repository (or copy the script locally).
2. :