CVE-2005-1413
envivo_cms - SQL Injection via Username or Password Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2005-1413. PoCs published by durito.
AI-analyzed exploit summary This exploit demonstrates an SQL injection vulnerability in enVivo!CMS by injecting a malicious SQL query into the 'ID' parameter. The query extracts the first username from the 'users' table, confirming the vulnerability.
Description
Multiple SQL injection vulnerabilities in enVivo!CMS allow remote attackers to execute arbitrary SQL commands and gain privileges via the (1) username or (2) password parameters to admin_login.asp, or the (3) searchstring and possibly (4) ID parameters to default.asp.
Exploits (1)
This exploit demonstrates an SQL injection vulnerability in enVivo!CMS by injecting a malicious SQL query into the 'ID' parameter. The query extracts the first username from the 'users' table, confirming the vulnerability.