CVE-2005-2113

XOOPS <= 2.0.11 - SQL Injection via XMLRPC LoginUser Function

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2005-2113. PoCs published by RusH.

AI-analyzed exploit summary This exploit targets a SQL injection vulnerability in Xoops <= 2.0.11 via the xmlrpc.php endpoint. It performs a blind SQL injection to extract user password hashes by brute-forcing each character of the hash.

Description

SQL injection vulnerability in the loginUser function in the XMLRPC server in XOOPS 2.0.11 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via crafted values in an XML file, as demonstrated using the blogger.getPost method.

Exploits (2)

exploitdb WORKING POC VERIFIED
by RusH · perlwebappsphp
https://www.exploit-db.com/exploits/1082

This exploit targets a SQL injection vulnerability in Xoops <= 2.0.11 via the xmlrpc.php endpoint. It performs a blind SQL injection to extract user password hashes by brute-forcing each character of the hash.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: Xoops <= 2.0.11
No auth needed
Prerequisites: Target must have Xoops <= 2.0.11 installed · XML-RPC endpoint must be accessible · Valid username must be known
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP
webappsphp
https://www.exploit-db.com/exploits/43827

This is a detailed technical writeup describing multiple vulnerabilities in XOOPS, including SQL injection via XMLRPC and cross-site scripting (XSS) flaws. It provides specific exploit examples, affected code snippets, and mitigation steps.

Classification
Writeup 95%
Attack Type
Sqli | Xss
Complexity
Moderate
Reliability
Reliable
Target: XOOPS <= 2.0.11
No auth needed
Prerequisites: Access to the XOOPS XMLRPC endpoint · Ability to send crafted HTTP requests
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (4)

Core 4
Core References
Mailing List mailing-list x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=112006318512991&w=2
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/15843

Scores

EPSS 0.0125
EPSS Percentile 65.4%

Details

Status published
Products (15)
xoops/xoops 2.0
xoops/xoops 2.0.1
xoops/xoops 2.0.2
xoops/xoops 2.0.3
xoops/xoops 2.0.4
xoops/xoops 2.0.5
xoops/xoops 2.0.5.1
xoops/xoops 2.0.5.2
xoops/xoops 2.0.6
xoops/xoops 2.0.7
... and 5 more
Published Jul 05, 2005
Tracked Since Feb 18, 2026