andreaf17/poc-cve-2024-44349Proof-of-concept exploit for CVE-2024-44349, an SQL injection in Anteeo WMS v4.7.x, enabling database dumping and arbitrary SQL query execution.
Vulnerability found and tested in Anteeo WMS - v4.7.31
The vulnerability allows threat actors to craft an SQL command inside the username parameter and disclose data in the underlying database. The impacted versions of ANTEEO B2B WMS are from v.4.7.x to v.4.7.34 (excluded).
git clone [email protected]:AndreaF17/PoC-CVE-2024-44349.gitcd PoC-CVE-2024-44349python3 -m venv venvsource venv/bin/activatepip3 install -r requirements.txtpython3 ./main.py -t TARGET -m [MODE]Before starting a MODE the script check if ANTEEO is vulnerable and procedes. The available modes are:
python3 ./main.py -t TARGET -m dump, dumps the DB.python3 ./main.py -t TARGET -m query, opens a shell where you can send SQL query on the server.Inside the utils/utils.py there are some functions to extract data from the DB.
This PoC was developed for research and educational purposes only. It is provided "as-is," without any warranties, and the author takes no responsibility for any damage caused by its use.
By using this PoC, you agree that:
Use at your own risk and ensure compliance with applicable laws.