vicidial-cve-2024-8503-blind-sqli-poc

Unauthenticated time-based blind SQL injection proof of concept for VICIdial's VERM_AJAX_functions.php endpoint (CVE-2024-8503). The project is intended for authorized security testing, validation, and education only.

Overview

CVE-2024-8503 is an unauthenticated SQL injection in VICIdial where a crafted Basic Auth username value can reach vulnerable query logic in VERM_AJAX_functions.php. This PoC uses time-based inference to confirm exploitability and extract limited metadata and table data in a controlled way.

Features

• Time-based blind SQLi extraction engine using binary search by ASCII
• Resumable scans with on-disk state
• Metadata extraction for version, DB name, DB user, hostname, privileges, and table count
• Table, column, and row discovery with strict caps
• Manual and auto extraction modes
• CSV and JSON export
• Self-check mode with no network activity

Safety Limits

This release enforces strict proof-of-concept limits:

• Tables: 10
• Columns per table: 10
• Rows per table: 10
• Per-cell extraction length: 100 characters
• Metadata max length: 250 characters

Requirements

• Python 3.8+
• requests

Installation

Install dependencies:

pip install requests

Quick Start

Run the local self-check to confirm configuration without making any network requests:

python3 CVE-2024-8503-POC.py --self-check

Run a basic non-interactive scan:

python3 CVE-2024-8503-POC.py --url https://target.tld

Interactive Mode

Interactive mode is a separate workflow for operator-driven testing. It is useful when you want to step through extraction tasks manually instead of running a single command.

python3 CVE-2024-8503-POC.py --url https://target.tld --interactive

The interactive menu supports metadata extraction, table and column discovery, manual extraction, auto-extraction, custom queries, and resumable full scans.

Command-Line Usage

Use these commands when you want a specific task without entering the interactive menu.

Extract metadata:

python3 CVE-2024-8503-POC.py --url https://target.tld --metadata db_version database db_user

List tables:

python3 CVE-2024-8503-POC.py --url https://target.tld --list-tables

Get columns for a table:

python3 CVE-2024-8503-POC.py --url https://target.tld --get-columns call_log

Extract specific columns:

python3 CVE-2024-8503-POC.py --url https://target.tld --table call_log --columns uniqueid,channel --rows 3

Auto-extract table data:

python3 CVE-2024-8503-POC.py --url https://target.tld --auto-extract call_log

Full scan:

python3 CVE-2024-8503-POC.py --url https://target.tld --full-scan

Custom query (SELECT only):

python3 CVE-2024-8503-POC.py --url https://target.tld --custom-query "SELECT DATABASE()"

Optional flags:

• --path to change the endpoint path (default: /VERM/VERM_AJAX_functions.php)
• --skip-vuln-check to skip the initial confirmation probe
• --export to save results (JSON for metadata/full scan, CSV for table data)

Resumable Scans

Progress is saved automatically to:

.vicidial_scan_state.json

If a previous scan is detected, the script will offer to resume or clear state.

Project Notes

• The interactive workflow is intended as a different operator experience from the standard command-line flow.
• The tool keeps extraction capped to a small, demonstrable proof-of-concept scope.
• A matching LICENSE file should be added at the repository root; this README assumes MIT.

Legal Disclaimer

This tool is provided for authorized security testing and educational purposes only. Unauthorized access to computer systems is illegal. You must obtain explicit written permission before testing any systems you do not own. The author assumes no liability for misuse or damage caused by this tool.

License

This project is licensed under the MIT License. See the repository-level LICENSE file for the details.

Updates

• 2026-04-29: Added self-check mode and enforced strict 10/10/10 limits.

Changelog

1.0.0

• Enforced strict PoC limits for tables, columns, and rows.
• Added resumable scans and self-check mode.