CVE-2005-1779

MaxWebPortal 1.35, 1.36, 2.0, 20050418 Next - SQL Injection via memKey Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2005-1779. PoCs published by Alpha_Programmer, mh_p0rtal, Soroush Dalili.

AI-analyzed exploit summary This exploit targets MAX Portal by injecting SQL payloads to reset the admin password. It sends a crafted POST request to the password reset endpoint, leveraging SQL injection to change the admin password to 'trapset'.

Description

SQL injection vulnerability in password.asp in MaxWebPortal 1.35, 1.36, 2.0, and 20050418 Next allows remote attackers to execute arbitrary SQL commands via the memKey parameter.

Exploits (3)

exploitdb WORKING POC VERIFIED
by Alpha_Programmer · perlwebappsasp
https://www.exploit-db.com/exploits/1010

This exploit targets MAX Portal by injecting SQL payloads to reset the admin password. It sends a crafted POST request to the password reset endpoint, leveraging SQL injection to change the admin password to 'trapset'.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: MAX Portal (versions 1.35 and older, 1.36, 2.0 and newer)
No auth needed
Prerequisites: Network access to the target web server · MAX Portal installation with vulnerable password reset functionality
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by mh_p0rtal · phpwebappsasp
https://www.exploit-db.com/exploits/1011

This exploit leverages a SQL injection vulnerability in WebMaxPortal's password reset functionality to change the admin password. It provides two payloads tailored for different versions of the software.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: WebMaxPortal Version 1.35 and older, Version 1.36, 2.0
No auth needed
Prerequisites: Access to the target URL with the vulnerable password reset endpoint
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Soroush Dalili · textwebappsasp
https://www.exploit-db.com/exploits/1012

This exploit demonstrates a SQL injection vulnerability in Maxwebportal versions 1.35, 1.36, 2.0, and 20050418 Next. The vulnerability allows an attacker to reset the password of any user, including the admin, by manipulating the 'memKey' parameter in the password reset form.

Classification
Working Poc 100%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: Maxwebportal versions 1.35, 1.36, 2.0, 20050418 Next
No auth needed
Prerequisites: Access to the target's password.asp page
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Vendor Advisory vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1014048
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/15511

Scores

EPSS 0.0203
EPSS Percentile 78.5%

Details

Status published
Products (4)
maxwebportal/maxwebportal 1.35
maxwebportal/maxwebportal 1.36
maxwebportal/maxwebportal 2.0
maxwebportal/maxwebportal 2005-04-18
Published May 31, 2005
Tracked Since Feb 18, 2026