CVE-2006-7172
php-stats < 0.1.9.1b - SQL Injection via HTTP Header or IP Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-7172. PoCs published by rgod.
AI-analyzed exploit summary This exploit leverages SQL injection via the HTTP header 'PC-REMOTE-ADDR' in Php-Stats <= 0.1.9.1b to extract the admin password from the database. The payload injects a UNION-based SQL query to retrieve the password from the 'php_stats_config' table.
Description
Multiple SQL injection vulnerabilities in php-stats.recphp.php in PHP-Stats 0.1.9.1b and earlier allow remote attackers to execute arbitrary code via a leading dotted-quad IP address string in the (1) PC-REMOTE-ADDR HTTP header, which is inserted into $_SERVER['HTTP_PC_REMOTE_ADDR'], or (2) ip parameter.
Exploits (2)
This exploit leverages SQL injection via the HTTP header 'PC-REMOTE-ADDR' in Php-Stats <= 0.1.9.1b to extract the admin password from the database. The payload injects a UNION-based SQL query to retrieve the password from the 'php_stats_config' table.
This exploit targets a SQL injection vulnerability in Php-Stats <= 0.1.9.1b via the 'ip' parameter, bypassing input validation through urldecode() and ereg() limitations. It discloses the admin password by injecting a UNION-based SQL query.