CVE-2006-4612
ZIXForum 1.12 - SQL Injection via ReplyNew.asp RepId Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-4612. PoCs published by SlimTim10, Chironex Fleckeri.
AI-analyzed exploit summary This Perl script exploits a SQL injection vulnerability in ZIXForum <= v1.12 by injecting malicious SQL queries into the 'RepId' parameter to extract admin credentials from the 'adminlogins' table. It sends two HTTP requests to retrieve the username and password separately.
Description
SQL injection vulnerability in ReplyNew.asp in ZIXForum 1.12 allows remote attackers to execute arbitrary SQL commands via the RepId parameter.
Exploits (2)
This Perl script exploits a SQL injection vulnerability in ZIXForum <= v1.12 by injecting malicious SQL queries into the 'RepId' parameter to extract admin credentials from the 'adminlogins' table. It sends two HTTP requests to retrieve the username and password separately.
This exploit demonstrates a SQL injection vulnerability in ZIXForum 1.12 by manipulating the 'RepId' parameter to extract admin credentials. The PoC provides direct URLs to retrieve usernames and passwords from the 'adminlogins' table.