CVE-2006-0823
Geeklog 1.4.0-1.4.0sr1 and 1.3.11-1.3.11sr4 - SQL Injection via Userid or Sessid Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-0823. PoCs published by GulfTech Security.
AI-analyzed exploit summary This is a detailed writeup describing SQL injection and arbitrary file inclusion vulnerabilities in Geeklog <= 1.4.0. It explains how unsanitized cookie values can lead to SQLi and file inclusion, potentially resulting in remote code execution.
Description
Multiple SQL injection vulnerabilities in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allow remote attackers to inject arbitrary SQL commands via the (1) userid variable to users.php or (2) sessid variable to lib-sessions.php.
Exploits (1)
This is a detailed writeup describing SQL injection and arbitrary file inclusion vulnerabilities in Geeklog <= 1.4.0. It explains how unsanitized cookie values can lead to SQLi and file inclusion, potentially resulting in remote code execution.