CVE-2006-0324

WebspotBlogging 3.0 - SQL Injection via Login Username Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-0324. PoCs published by Aliaksandr Hartsuyeu.

AI-analyzed exploit summary This exploit demonstrates an SQL injection vulnerability in WebspotBlogging's login.php. The PoC uses a UNION-based SQLi to bypass authentication by injecting malicious input into the username field.

Description

SQL injection vulnerability in WebspotBlogging 3.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter to login.php.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Aliaksandr Hartsuyeu · textwebappsphp

https://www.exploit-db.com/exploits/27114

View Code ZIP pw:eip

This exploit demonstrates an SQL injection vulnerability in WebspotBlogging's login.php. The PoC uses a UNION-based SQLi to bypass authentication by injecting malicious input into the username field.

Classification

Working Poc 90%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: WebspotBlogging (version unspecified)

No auth needed

Prerequisites: Access to the login page of the vulnerable application

MITRE ATT&CK