Homey BNB SQL Injection Vulnerability

A SQL injection vulnerability has been identified in Homey BNB version 4. This vulnerability allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pt' parameter. Exploitation of this vulnerability involves sending GET requests to the 'admin/getcmsdata.php' endpoint with crafted 'pt' values, enabling attackers to extract sensitive information from the database.

Impact

Exploitation of this vulnerability allows for unauthorized database access and data extraction, potentially leading to exposure of sensitive information.

Reproduction

To reproduce this vulnerability, send a GET request to the 'admin/getcmsdata.php' endpoint with a crafted 'pt' parameter that includes SQL injection payloads. The injected SQL code can be used to manipulate the database query and extract information from the database.