CVE-2006-0079

ScozNet ScozBook BETA 1.1 - SQL Injection via Username Field

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-0079. PoCs published by Aliaksandr Hartsuyeu.

AI-analyzed exploit summary This exploit demonstrates an SQL injection vulnerability in ScozNet ScozBook's authentication mechanism. By injecting a crafted username, an attacker can bypass authentication without valid credentials.

Description

SQL injection vulnerability in auth.php in ScozNet ScozBook BETA 1.1 allows remote attackers to execute arbitrary SQL commands via the username field (adminname variable).

Exploits (1)

exploitdb WORKING POC VERIFIED

by Aliaksandr Hartsuyeu · textwebappsphp

https://www.exploit-db.com/exploits/27018

View Code ZIP pw:eip

This exploit demonstrates an SQL injection vulnerability in ScozNet ScozBook's authentication mechanism. By injecting a crafted username, an attacker can bypass authentication without valid credentials.

Classification

Working Poc 90%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: ScozNet ScozBook

No auth needed

Prerequisites: Access to the target application's login page

MITRE ATT&CK