deluxe89
Source-scoped identity with 4 associated PoCs and 2 linked vulnerabilities.
Exploit catalog results
Showing 4 PoCs on this page
ExploitDBWoltlab Burning Board 2.3.1 - 'register.php' SQL Injection
ExploitDB exploitPublished 2005-05-20ExploitUnlinked1 file
Analysis
Technical assessment
Perl script that exploits a SQL injection vulnerability in Woltlab Burning Board 2.3.1 register.php to extract a user's password hash character by character using blind SQL injection techniques.
Backdoor review
No backdoor observed in reviewed code
The supplied Perl script is a proof-of-concept exploit for a SQL injection vulnerability in Woltlab Burning Board 2.3.1. It performs a blind SQL injection to extract a password hash character by character from the target application. No backdoor, deceptive payload, or unrelated harmful behavior is present in the reviewed code.
Classification basis and observed behavior
Classification basis
The script actively exploits a SQL injection vulnerability by sending crafted HTTP requests to extract a password hash from the database. It does not merely check for the vulnerability but performs data extraction, which is the defining characteristic of an exploit.
exploits/php/webapps/1006.pl:85-88exploits/php/webapps/1006.pl:49-76Requirements
- Target must be running Woltlab Burning Board <= 2.3.1
exploits/php/webapps/1006.pl:8 - Attacker must know a valid username on the board
exploits/php/webapps/1006.pl:20 - Attacker must know the userid of the target user
exploits/php/webapps/1006.pl:19 - Attacker must know the error message for duplicate email in the board's language
exploits/php/webapps/1006.pl:22
Observed behavior
- Sends HTTP POST requests to register.php with a malicious email parameter containing a SQL injection payload
exploits/php/webapps/1006.pl:85-90 - Uses blind SQL injection with ASCII-based character comparison to extract the password hash one character at a time
exploits/php/webapps/1006.pl:49-76 - Determines if a character is a letter or number by testing ASCII range 97-102 vs 48-57
exploits/php/webapps/1006.pl:53-75 - Prints the extracted password hash to stdout
exploits/php/webapps/1006.pl:45
Behaviors behind the backdoor verdict
Observables
- Target Host
- Payload withheldThe script is hardcoded to target this host, which is a security research site, not a malicious command-and-control server.
exploits/php/webapps/1006.pl:17 - Sql Injection Payload
- Payload withheldThe script constructs a SQL injection payload to extract the password hash of a specified user via blind boolean-based injection. This is the core exploit behavior.
exploits/php/webapps/1006.pl:85-87 - Exploit Technique
- Payload withheldThe script sends crafted POST requests to the registration endpoint and infers character values based on the presence of a specific error message in the response.
exploits/php/webapps/1006.pl:80-98
What the analysis did not establish
- Only the exploit script is provided; no external dependencies or target environment are included.
- The script contains hardcoded target details (host, path, userid, username) that must be modified for use against other targets.
- The script assumes a German-language board error message by default; English alternative is noted in comments.
- Only the exploit script itself was reviewed; no external dependencies, libraries, or referenced resources were inspected.
- The script's network behavior was not executed or dynamically analyzed; the review is based solely on static analysis of the provided source code.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.