Exploitation Summary
EIP tracks 2 public exploits for CVE-2006-1330. PoCs published by DaBDouB-MoSiKaR.
AI-analyzed exploit summary The exploit demonstrates SQL injection in phpWebSite via the 'sid' parameter in friend.php, allowing unauthorized data extraction from the 'users' table. It leverages a UNION-based attack to retrieve sensitive information like usernames and passwords.
Description
Multiple SQL injection vulnerabilities in phpWebsite 0.83 and earlier allow remote attackers to execute arbitrary SQL commands via the sid parameter to (1) friend.php or (2) article.php.
Exploits (2)
The exploit demonstrates SQL injection in phpWebSite via the 'sid' parameter in friend.php, allowing unauthorized data extraction from the 'users' table. It leverages a UNION-based attack to retrieve sensitive information like usernames and passwords.
The provided text describes a SQL injection vulnerability in phpWebSite versions 0.83 and prior, where user-supplied input is not properly sanitized before being used in SQL queries. The example URL demonstrates how an attacker could exploit this vulnerability by injecting malicious SQL code via the 'sid' parameter.