CVE-2005-4139
ThWboard < 3 Beta 2.84 - SQL Injection via Calendar Year Parameter
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2005-4139. PoCs published by trueend5.
AI-analyzed exploit summary The provided text describes multiple input validation vulnerabilities in ThWboard, including SQL injection, HTML injection, and cross-site scripting (XSS). It outlines the lack of proper sanitization of user-supplied input and potential impacts such as credential theft and arbitrary code execution.
Description
Multiple SQL injection vulnerabilities in ThWboard before 3 Beta 2.84 allow remote attackers to execute arbitrary SQL commands via the (1) year parameter in calendar.php, (2) user parameter array in v_profile.php, and (3) the userid parameter in misc.php.
Exploits (3)
The provided text describes multiple input validation vulnerabilities in ThWboard, including SQL injection, HTML injection, and cross-site scripting (XSS). It outlines the lack of proper sanitization of user-supplied input and potential impacts such as credential theft and arbitrary code execution.
The provided text describes multiple input validation vulnerabilities in ThWboard, including SQL injection, HTML injection, and XSS. It includes a sample SQL injection URL but lacks executable exploit code.
The provided text describes multiple input validation vulnerabilities in ThWboard, including SQL injection, HTML injection, and XSS. It includes a sample SQL injection URL but lacks executable exploit code.