CVE-2005-3305
Nuked Klan 1.7 - SQL Injection via Forum, Links, Sections, or Download Parameters
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2005-3305. PoCs published by papipsycho.
AI-analyzed exploit summary The provided text describes SQL injection vulnerabilities in Nuked Klan due to unsanitized user input in SQL queries. It includes a sample exploit URL but lacks executable code.
Description
Multiple SQL injection vulnerabilities in Nuked Klan 1.7 allow remote attackers to execute arbitrary SQL commands via the (1) forum_id or (2) thread_id parameter in the Forum file, (3) the link_id in the Links file, (4) the artid parameter in the Sections file, and (5) the dl_id parameter in the Download file.
Exploits (4)
The provided text describes SQL injection vulnerabilities in Nuked Klan due to unsanitized user input in SQL queries. It includes a sample exploit URL but lacks executable code.
This exploit demonstrates SQL injection in Nuked Klan 1.7 by injecting a UNION-based query to extract user credentials (MD5 password hashes and IDs) from the database. It constructs a malicious URL to retrieve data from the `nuked_users` table.
The exploit demonstrates SQL injection vulnerabilities in Nuked Klan by manipulating the 'forum_id' and 'thread_id' parameters in a URL. The payloads use SQL comments and wildcards to bypass input sanitization, potentially allowing unauthorized data access or manipulation.
The provided text describes SQL injection vulnerabilities in Nuked Klan, specifically in the 'dl_id' parameter. It includes a sample URL demonstrating the vulnerability but lacks executable exploit code.