CVE-2005-3952
PHP Labs Top Auction - SQL Injection via Category or Type Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2005-3952. PoCs published by ajann.
AI-analyzed exploit summary This Perl script exploits a blind SQL injection vulnerability in Top Auction 1.0's viewcat.php by injecting a UNION-based query to extract admin credentials. It sends an HTTP request with a crafted payload to retrieve username and password from the users table.
Description
SQL injection vulnerability in PHP Labs Top Auction allows remote attackers to execute arbitrary SQL commands via the (1) category and (2) type parameters to viewcat.php, or (3) certain search parameters. NOTE: later a disclosure reported the affected version as 1.0.
Exploits (1)
This Perl script exploits a blind SQL injection vulnerability in Top Auction 1.0's viewcat.php by injecting a UNION-based query to extract admin credentials. It sends an HTTP request with a crafted payload to retrieve username and password from the users table.