Unauthenticated SQL Injection RCE in Ivanti Endpoint Manager

This repository is a small standalone Python proof-of-concept exploit for CVE-2024-50330 targeting Ivanti Endpoint Manager. It contains only two files: a README describing the vulnerability and exploitation concept, and exploit.py implementing the attack. The script is not part of a larger exploit framework. The exploit logic is straightforward: it accepts a target base URL, builds a malicious request path using a hardcoded placeholder endpoint (/some_endpoint) and injectable query parameter (param), then sends unauthenticated HTTP GET requests with SQL injection payloads. In the default UNION-style path, it first attempts to enable SQL Server xp_cmdshell by issuing sp_configure and RECONFIGURE statements, then sends a second injected request to run an arbitrary operating system command, defaulting to whoami. If output handling is requested, the HTTP response body is printed or saved to a user-specified local file. A second mode implements time-based blind SQL injection. That path checks sys.configurations, conditionally enables xp_cmdshell, and uses WAITFOR DELAY to provide timing-based confirmation. It then executes the supplied command with another delayed payload, but does not retrieve command output directly. Notable capabilities: pre-auth remote exploitation over HTTP(S), SQL Server reconfiguration, arbitrary command execution, optional response capture, SSL verification disabling, and configurable timeout. Important caveat: the vulnerable endpoint path appears to be a placeholder rather than a confirmed Ivanti EPM route, so while the code demonstrates realistic SQLi-to-xp_cmdshell tradecraft, it may require adaptation to a real vulnerable endpoint before working against an actual target.