Exploitation Summary
EIP tracks 12 public exploits for CVE-2006-5829. PoCs published by laurent gaffie.
AI-analyzed exploit summary The provided text describes a SQL injection vulnerability in All In One Control Panel (AIOCP) versions 1.3.007 and prior. The vulnerability arises from insufficient input sanitization, allowing attackers to manipulate the 'order_field' parameter in 'cp_users_online.php' to execute arbitrary SQL queries.
Description
Multiple SQL injection vulnerabilities in All In One Control Panel (AIOCP) 1.3.007 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) choosed_language parameter to (a) cp_dpage.php, (b) cp_news.php, (c) cp_forum_view.php, (d) cp_edit_user.php, (e) cp_newsletter.php, (f) cp_links.php, (g) cp_contact_us.php, (h) cp_login.php, and (i) cp_codice_fiscale.php in public/code/; (2) news_category parameter to public/code/cp_news.php; (3) nlmsg_nlcatid parameter to public/code/cp_newsletter.php; (4) links_category parameter to public/code/cp_links.php; (5) product_category_id parameter to public/code/cp_show_ec_products.php; (6) order_field parameter to public/code/cp_show_ec_products.php; (7) firstrow parameter to public/code/cp_users_online.php; and (8) orderdir parameter to public/code/cp_links_search.php.
Exploits (12)
The provided text describes a SQL injection vulnerability in All In One Control Panel (AIOCP) versions 1.3.007 and prior. The vulnerability arises from insufficient input sanitization, allowing attackers to manipulate the 'order_field' parameter in 'cp_users_online.php' to execute arbitrary SQL queries.
The provided text describes SQL injection vulnerabilities in All In One Control Panel (AIOCP) versions 1.3.007 and prior. It outlines vulnerable parameters in specific URLs but does not include executable exploit code.
The provided text describes SQL injection vulnerabilities in All In One Control Panel (AIOCP) due to insufficient input sanitization. It includes example URLs demonstrating the vulnerable parameters but lacks executable exploit code.
The provided text describes SQL injection vulnerabilities in All In One Control Panel (AIOCP) due to insufficient input sanitization. It includes example URLs demonstrating the vulnerability but lacks executable exploit code.
The provided text describes a vulnerability in All In One Control Panel (AIOCP) versions 1.3.007 and prior, which is prone to input-validation vulnerabilities. The example URL demonstrates a potential SQL injection vector via the 'choosed_language' parameter.
The provided text describes a SQL injection vulnerability in All In One Control Panel (AIOCP) versions 1.3.007 and prior. It highlights the lack of input sanitization, which could allow attackers to execute arbitrary SQL commands.
The provided text describes SQL injection vulnerabilities in All In One Control Panel (AIOCP) due to insufficient input sanitization. It includes example URLs demonstrating the vulnerable parameters but lacks executable exploit code.
The provided text describes a vulnerability in All In One Control Panel (AIOCP) versions 1.3.007 and prior, highlighting input-validation issues that could lead to SQL injection and other attacks. It includes a sample URL demonstrating the vulnerability but lacks executable exploit code.
The provided text describes a vulnerability in All In One Control Panel (AIOCP) versions 1.3.007 and prior, which is prone to input-validation vulnerabilities. The example URL demonstrates a potential SQL injection vector via the 'choosed_language' parameter.
The provided text describes a vulnerability in All In One Control Panel (AIOCP) versions 1.3.007 and prior, which is prone to input-validation vulnerabilities. The example URL demonstrates a potential SQL injection vector via the 'choosed_language' parameter.
The provided text describes a vulnerability in All In One Control Panel (AIOCP) versions 1.3.007 and prior, highlighting input-validation vulnerabilities that could lead to SQL injection, XSS, or other attacks. It includes a sample URL demonstrating the vulnerability but lacks executable exploit code.
The provided text describes a vulnerability in All In One Control Panel (AIOCP) versions 1.3.007 and prior, which is prone to input-validation vulnerabilities. The example URL demonstrates a potential SQL injection vector via the 'choosed_language' parameter.