Exploitation Summary
EIP tracks 1 public exploit for CVE-2006-4043. PoCs published by rgod.
AI-analyzed exploit summary This exploit demonstrates SQL injection in MyBloggie <= 2.1.4 via the trackback.php file, allowing an attacker to disclose administrative credentials by injecting malicious SQL queries into the 'title', 'url', 'excerpt', and 'blog_name' parameters. The exploit bypasses magic_quotes_gpc using URL encoding and retrieves the admin username and password hash from the database.
Description
index.php in myWebland myBloggie 2.1.4 and earlier allows remote attackers to obtain sensitive information via a query that only specifies the viewdate mode, which reveals the table prefix in a SQL error message.
Exploits (1)
This exploit demonstrates SQL injection in MyBloggie <= 2.1.4 via the trackback.php file, allowing an attacker to disclose administrative credentials by injecting malicious SQL queries into the 'title', 'url', 'excerpt', and 'blog_name' parameters. The exploit bypasses magic_quotes_gpc using URL encoding and retrieves the admin username and password hash from the database.