CVE-2005-2468
MySQL Eventum <= 1.5.5 - SQL Injection via Multiple Functions
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2005-2468. PoCs published by GulfTech Security.
AI-analyzed exploit summary This Perl script exploits a SQL injection vulnerability in MySQL Eventum <= v1.5.5 by brute-forcing the admin password hash via a UNION-based attack. It iterates through possible characters to extract the password hash one character at a time.
Description
Multiple SQL injection vulnerabilities in MySQL Eventum 1.5.5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) isCorrectPassword or (2) userExist function in class.auth.php, getCustomFieldReport function in (4) custom_fields.php, (5) custom_fields_graph.php, or (6) class.report.php, or the insert function in (7) releases.php or (8) class.release.php.
Exploits (1)
This Perl script exploits a SQL injection vulnerability in MySQL Eventum <= v1.5.5 by brute-forcing the admin password hash via a UNION-based attack. It iterates through possible characters to extract the password hash one character at a time.