CVE-2006-0234

microBlog 2.0 RC-10 - SQL Injection via Month or Year Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-0234. PoCs published by Aliaksandr Hartsuyeu.

AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in microBlog by injecting a UNION SELECT statement via the 'month' and 'year' parameters. It bypasses input sanitization to extract data from the database.

Description

SQL injection vulnerability in index.php in microBlog 2.0 RC-10 allows remote attackers to execute arbitrary SQL commands via the (1) month and (2) year parameters.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Aliaksandr Hartsuyeu · textwebappsphp

https://www.exploit-db.com/exploits/27100

View Code ZIP pw:eip

This exploit demonstrates a SQL injection vulnerability in microBlog by injecting a UNION SELECT statement via the 'month' and 'year' parameters. It bypasses input sanitization to extract data from the database.

Classification

Working Poc 90%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: microBlog (version not specified)

No auth needed

Prerequisites: Access to the vulnerable microBlog application

MITRE ATT&CK