CVE-2005-4169
eFiction 1.0 - SQL Injection via Authors Viewlist or Viewstory Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2005-4169. PoCs published by [email protected].
AI-analyzed exploit summary The exploit demonstrates SQL injection vulnerabilities in eFiction by crafting malicious UNION SELECT queries to extract sensitive data (passwords and usernames) from the fanfiction_authors table. It targets the 'sid' parameter in viewstory.php without requiring authentication.
Description
Multiple SQL injection vulnerabilities in eFiction 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) let parameter in a viewlist action to authors.php and (2) sid parameter to viewstory.php.
Exploits (1)
The exploit demonstrates SQL injection vulnerabilities in eFiction by crafting malicious UNION SELECT queries to extract sensitive data (passwords and usernames) from the fanfiction_authors table. It targets the 'sid' parameter in viewstory.php without requiring authentication.