CVEs-PoC/2009/CVE-2009-3255.md

CVE-2009-3255

Description

SQL injection vulnerability in RASH Quote Management System (RQMS) 1.2.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the user parameter in an admin action to the default URI.

POC

Reference

• http://packetstormsecurity.org/0908-exploits/rqms-bypass.txt
• http://packetstormsecurity.org/0908-exploits/rqms-bypass.txt

Github

No PoCs found on GitHub currently.