CVE-2004-0300
Online Store Kit 3.0 - SQL Injection via shop.php cat Parameter
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2004-0300. PoCs published by G00db0y, David Sopas Ferreira.
AI-analyzed exploit summary The provided text describes a SQL injection vulnerability in Online Store Kit, where insufficient input sanitization allows attackers to manipulate database queries via the URI parameter 'cat_manufacturer'. This can lead to information disclosure, including administrator password hashes.
Description
SQL injection vulnerability in Online Store Kit 3.0 allows remote attackers to inject arbitrary SQL and gain unauthorized access via (1) the cat parameter in shop.php, (2) the id parameter in more.php, (3) the cat_manufacturer parameter in shop_by_brand.php, or (4) the id parameter in listing.php.
Exploits (4)
The provided text describes a SQL injection vulnerability in Online Store Kit, where insufficient input sanitization allows attackers to manipulate database queries via the URI parameter 'cat_manufacturer'. This can lead to information disclosure, including administrator password hashes.
The provided text describes a SQL injection vulnerability in Online Store Kit, where insufficient input sanitization allows attackers to manipulate database queries via the 'cat' parameter in the URI. This can lead to information disclosure, including the administrator password hash.
The provided text describes a SQL injection vulnerability in Online Store Kit, where insufficient input sanitization allows attackers to manipulate database queries via the URI. It mentions the potential to disclose the administrator password hash but does not include actual exploit code.
The provided text describes SQL injection and XSS vulnerabilities in Online Store Kit 3.0 via the 'id' parameter in 'more.php'. It lacks executable exploit code but references known issues.