CVE-2006-2268
FlexCustomer <= 0.0.6 - SQL Injection via checkuser/checkpass or username/password Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-2268. PoCs published by Osirys.
AI-analyzed exploit summary This exploit demonstrates an SQL injection vulnerability in Flexcustomer's admin login and a potential PHP code injection via an unremoved install.php file. The SQLi allows admin login bypass using a trivial payload, while the PHP injection could lead to RCE if the install file is accessible.
Description
SQL injection vulnerability in FlexCustomer 0.0.4 and earlier allows remote attackers to bypass authentication and execute arbitrary SQL commands via the admin and ordinary user interface, probably involving the (1) checkuser and (2) checkpass parameters to (a) admin/index.php, and (3) username and (4) password parameters to (b) index.php. NOTE: it was later reported that 0.0.6 is also affected.
Exploits (1)
This exploit demonstrates an SQL injection vulnerability in Flexcustomer's admin login and a potential PHP code injection via an unremoved install.php file. The SQLi allows admin login bypass using a trivial payload, while the PHP injection could lead to RCE if the install file is accessible.