CVE-2005-4563

Enterprise Heart Enterprise Connector 1.0.2 - SQL Injection

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2005-4563. PoCs published by Attila Gerendi.

AI-analyzed exploit summary This exploit demonstrates an SQL injection vulnerability in Enterprise Connector by injecting a malformed username that triggers a database error, bypassing authentication. The payload leverages the `isnull(1/0)` function to force an error condition, allowing unauthorized access.

Description

SQL injection vulnerability in main.php in Enterprise Heart Enterprise Connector 1.0.2 allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the loginid parameter, a different vulnerability than CVE-2005-3875.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Attila Gerendi · textwebappsphp

https://www.exploit-db.com/exploits/26916

View Code ZIP pw:eip

This exploit demonstrates an SQL injection vulnerability in Enterprise Connector by injecting a malformed username that triggers a database error, bypassing authentication. The payload leverages the `isnull(1/0)` function to force an error condition, allowing unauthorized access.

Classification

Working Poc 90%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: Enterprise Connector (version unspecified)

No auth needed

Prerequisites: Network access to the target application · SQL injection vulnerability in the login mechanism

MITRE ATT&CK