BigAnt Office Messenger SQL Injection Vulnerability Leading to Remote Code Execution

A SQL injection vulnerability has been identified in BigAnt Office Messenger version 5.6.06. The issue arises in the 'dev_code' parameter, allowing attackers to manipulate SQL queries and execute arbitrary commands on the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected system.

Reproduction

To reproduce this vulnerability, send a crafted request that includes a SQL injection payload in the 'dev_code' parameter. The payload should be designed to exploit the application's SQL query handling, such as by extracting database information or executing commands. For example, after exploiting the SQL injection to extract the database version, the 'dev_code' parameter can be used to upload a PHP web shell to the server, which can then be accessed to execute commands.