CVE-2005-3682
Wizz Forum 1.20 - SQL Injection via AuthID TopicID Parameters
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2005-3682. PoCs published by HACKERS PAL.
AI-analyzed exploit summary This exploit targets a SQL injection vulnerability in Wizz Forum, allowing an attacker to retrieve user credentials (username and MD5 password hash) by manipulating the TopicID parameter. It uses a UNION-based SQL injection to extract data from the ForumUser table.
Description
Multiple SQL injection vulnerabilities in Wizz Forum 1.20 allow remote attackers to execute arbitrary SQL commands via (1) the AuthID parameter in ForumAuthDetails.php, and the TopicID parameter in (2) ForumTopicDetails.php and (3) ForumReply.php.
Exploits (3)
This exploit targets a SQL injection vulnerability in Wizz Forum, allowing an attacker to retrieve user credentials (username and MD5 password hash) by manipulating the TopicID parameter. It uses a UNION-based SQL injection to extract data from the ForumUser table.
The exploit demonstrates SQL injection in Wizz Forum via the TopicID parameter in ForumReply.php, allowing an attacker to extract user credentials (userid and password) from the ForumUser table.
This exploit demonstrates a SQL injection vulnerability in Wizz Forum by manipulating the 'AuthID' parameter in 'ForumAuthDetails.php'. The payload uses a UNION-based SQLi to extract sensitive data such as passwords and user IDs.