CVE-2006-4042
mybloggie < 2.1.4 - SQL Injection via trackback.php Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-4042. PoCs published by rgod.
AI-analyzed exploit summary This exploit demonstrates SQL injection in MyBloggie <= 2.1.4 via the trackback.php file, allowing an attacker to disclose administrative credentials by injecting malicious SQL queries into the 'title', 'url', 'excerpt', and 'blog_name' parameters. The exploit bypasses magic_quotes_gpc using URL encoding and retrieves the admin username and password hash from the database.
Description
Multiple SQL injection vulnerabilities in trackback.php in myWebland myBloggie 2.1.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) title, (2) url, (3) excerpt, or (4) blog_name parameters.
Exploits (1)
This exploit demonstrates SQL injection in MyBloggie <= 2.1.4 via the trackback.php file, allowing an attacker to disclose administrative credentials by injecting malicious SQL queries into the 'title', 'url', 'excerpt', and 'blog_name' parameters. The exploit bypasses magic_quotes_gpc using URL encoding and retrieves the admin username and password hash from the database.