Exploitation Summary
EIP tracks 3 public exploits for CVE-2005-4554. PoCs published by [email protected], rgod.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in Dev Web Management System. The PoC uses a UNION-based SQLi to extract the admin password from the 'variables1' table.
Description
Multiple SQL injection vulnerabilities in DEV web management system 1.5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) cat parameter in an openforum action (openforum.php) in index.php, (2) cat parameter in getfile.php, and (3) target parameter in download_now.php.
Exploits (3)
This exploit demonstrates a SQL injection vulnerability in Dev Web Management System. The PoC uses a UNION-based SQLi to extract the admin password from the 'variables1' table.
The provided text describes SQL injection and XSS vulnerabilities in Dev Web Management System 1.5 and earlier, with an example URL demonstrating SQL injection via the 'target' parameter. No actual exploit code is present.
This exploit targets a SQL injection vulnerability in Dev <=1.5, specifically in the 'cat' parameter, to disclose the admin MD5 password hash. It bypasses magic_quotes_gpc and includes functionality for proxy support and detailed output formatting.