CVE-2006-5236
4images 1.7.x - Authenticated SQL Injection via search_user Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-5236. PoCs published by Master Mind, Synsta.
AI-analyzed exploit summary This is a writeup describing a SQL injection vulnerability in 4images 1.7.1, allowing an attacker to extract admin credentials via union-based SQLi. The exploit involves retrieving the admin username and then the password hash.
Description
SQL injection vulnerability in search.php in 4images 1.7.x allows remote authenticated users to execute arbitrary SQL commands via the search_user parameter.
Exploits (2)
This is a writeup describing a SQL injection vulnerability in 4images 1.7.1, allowing an attacker to extract admin credentials via union-based SQLi. The exploit involves retrieving the admin username and then the password hash.
This exploit targets a SQL injection vulnerability in 4images 1.7.x via the 'search_user' parameter in search.php. It allows an attacker to extract user passwords (hashed) from the database by manipulating the SQL query through URL encoding.