CVE-2006-2300
EImagePro - SQL Injection via CatID, SubjectID, or Pic Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-2300. PoCs published by Dj_Eyes.
AI-analyzed exploit summary The provided text describes a SQL injection vulnerability in EImagePro, where the 'Pic' parameter in the URL is not properly sanitized. The example URL demonstrates a basic SQLi attempt using a single quote, but no actual exploit code is present.
Description
Multiple SQL injection vulnerabilities in EImagePro allow remote attackers to execute arbitrary SQL commands via the (1) CatID parameter to subList.asp, (2) SubjectID parameter to imageList.asp, or (3) Pic parameter to view.asp.
Exploits (2)
The provided text describes a SQL injection vulnerability in EImagePro, where the 'Pic' parameter in the URL is not properly sanitized. The example URL demonstrates a basic SQLi attempt using a single quote, but no actual exploit code is present.
The provided text describes SQL injection vulnerabilities in EImagePro due to unsanitized user input in the 'CatID' parameter. It includes a sample exploit URL but lacks executable code.