CVE-2004-1562

w-agora 4.1.6a - SQL Injection via redir_url.php key Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2004-1562. PoCs published by Alexander Antipov.

AI-analyzed exploit summary The provided text describes multiple vulnerabilities in W-Agora 4.1.6a, including SQL injection, XSS, and HTTP response splitting due to insufficient input sanitization. It includes a sample SQL injection vector via the 'redir_url.php' parameter.

Description

SQL injection vulnerability in redir_url.php in w-Agora 4.1.6a allows remote attackers to execute arbitrary SQL commands via the key parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Alexander Antipov · textwebappsphp

https://www.exploit-db.com/exploits/24648

View Code ZIP pw:eip

The provided text describes multiple vulnerabilities in W-Agora 4.1.6a, including SQL injection, XSS, and HTTP response splitting due to insufficient input sanitization. It includes a sample SQL injection vector via the 'redir_url.php' parameter.

Classification

Writeup 90%

Attack Type

Sqli | Xss | Other

Complexity

Trivial

Reliability

Theoretical

Target: W-Agora 4.1.6a

No auth needed

Prerequisites: Access to the vulnerable W-Agora instance

MITRE ATT&CK