Exploitation Summary
EIP tracks 1 public exploit for CVE-2004-1881. PoCs published by Nick Gudov.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in CactuShop, allowing an attacker to execute arbitrary SQL commands, including the execution of system commands via `xp_cmdshell`. The PoC includes URLs that inject malicious SQL queries to list directory contents or execute arbitrary commands.
Description
SQL injection vulnerability in (1) mailorder.asp or (2) payonline.asp in CactuShop 5.x allows remote attackers to execute arbitrary SQL commands via the strItems parameter.
Exploits (1)
This exploit demonstrates a SQL injection vulnerability in CactuShop, allowing an attacker to execute arbitrary SQL commands, including the execution of system commands via `xp_cmdshell`. The PoC includes URLs that inject malicious SQL queries to list directory contents or execute arbitrary commands.