CVE-2006-2363

Limbo CMS - SQL Injection via Weblinks catid Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-2363. PoCs published by [Oo].

AI-analyzed exploit summary This exploit targets a SQL injection vulnerability in Limbo CMS via the 'option=weblinks' parameter. It extracts user credentials (username and password) from the database by manipulating the 'catid' parameter with a UNION-based SQL injection.

Description

SQL injection vulnerability in the weblinks option (weblinks.html.php) in Limbo CMS allows remote attackers to execute arbitrary SQL commands via the catid parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by [Oo] · phpwebappsphp

https://www.exploit-db.com/exploits/1751

View Code ZIP pw:eip

This exploit targets a SQL injection vulnerability in Limbo CMS via the 'option=weblinks' parameter. It extracts user credentials (username and password) from the database by manipulating the 'catid' parameter with a UNION-based SQL injection.

Classification

Working Poc 95%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: Limbo CMS (version not specified)

No auth needed

Prerequisites: Target must be running Limbo CMS with vulnerable 'weblinks' option enabled · Attacker must know the target host, path, and a valid user ID

MITRE ATT&CK

T1189 - Drive-by Compromise T1505 - Server Software Component

devstral-2 · analyzed Feb 16, 2026 Full analysis →