CVE-2006-1422

This exploit targets a SQL injection vulnerability in PHP Booking Calendar 10d/10e, extracting admin credentials (username and password hash) via a crafted UNION-based SQL query. It uses LWP::UserAgent to send the malicious request and parse the response.

This exploit demonstrates a SQL injection vulnerability in phpBookingCalendar <= 1.0c, allowing an attacker to extract sensitive user credentials (username and password) from the database via a crafted UNION-based SQL query.