CVE-2006-1232
DSDownload 1.0 - SQL Injection via Key or Category Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-1232. PoCs published by Aliaksandr Hartsuyeu.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in DSDownload by injecting arbitrary SQL logic via the 'category' parameter in the downloads.php script. The attack leverages a UNION-based SQL injection to potentially access or modify sensitive database information.
Description
Multiple SQL injection vulnerabilities in DSDownload 1.0, with magic_quotes_gpc disabled, allow remote attackers to execute arbitrary SQL commands via the (1) key and (2) category parameters to (a) search.php and (b) downloads.php.
Exploits (1)
This exploit demonstrates a SQL injection vulnerability in DSDownload by injecting arbitrary SQL logic via the 'category' parameter in the downloads.php script. The attack leverages a UNION-based SQL injection to potentially access or modify sensitive database information.