CVE-2005-1287

BK Forum < 4 - SQL Injection via Member ID or Forum Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2005-1287. PoCs published by n0m3rcy.

AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in BK Forum <= 4.0, allowing an authenticated attacker to extract admin credentials via a crafted UNION SELECT query.

Description

Multiple SQL injection vulnerabilities in BK Forum 4.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to member.asp, (2) forum parameter to forum.asp, or (3) various parameters in register.asp.

Exploits (1)

exploitdb WORKING POC VERIFIED

by n0m3rcy · textwebappsasp

https://www.exploit-db.com/exploits/1714

View Code ZIP pw:eip

This exploit demonstrates a SQL injection vulnerability in BK Forum <= 4.0, allowing an authenticated attacker to extract admin credentials via a crafted UNION SELECT query.

Classification

Working Poc 90%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: BK Forum <= 4.0

Auth required

Prerequisites: Authenticated session · Knowledge of target URL structure

MITRE ATT&CK