CVE-2006-1543

VNews 1.2 - SQL Injection via loginvar Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-1543. PoCs published by Aliaksandr Hartsuyeu.

AI-analyzed exploit summary The exploit demonstrates a SQL injection vulnerability in VNews 1.2 by injecting a UNION-based payload into the 'news' parameter. This allows an attacker to manipulate SQL queries and potentially access or modify data in the underlying database.

Description

Multiple SQL injection vulnerabilities in vscripts (aka Kuba Kunkiewicz) VNews 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) loginvar parameter in (a) admin/admin.php, and the (2) news and (3) nom parameters in (b) news.php.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Aliaksandr Hartsuyeu · textwebappsphp

https://www.exploit-db.com/exploits/27513

View Code ZIP pw:eip

The exploit demonstrates a SQL injection vulnerability in VNews 1.2 by injecting a UNION-based payload into the 'news' parameter. This allows an attacker to manipulate SQL queries and potentially access or modify data in the underlying database.

Classification

Working Poc 90%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: VNews 1.2

No auth needed

Prerequisites: Target application must be VNews 1.2 or potentially other vulnerable versions · SQL injection vulnerability must be present in the 'news' parameter

MITRE ATT&CK

T1105 - Ingress Tool Transfer T1505 - Server Software Component

devstral-2 · analyzed Feb 16, 2026 Full analysis →