CVE-2007-0865
LushiNews <= 1.01 - Authenticated SQL Injection via Comments ID Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2007-0865. PoCs published by ajann.
AI-analyzed exploit summary This is a functional exploit for CVE-2007-0865, targeting a SQL injection vulnerability in LushiNews <= 1.01 via the 'comments.php' file. It extracts user credentials (username, password, email) from the database using a UNION-based SQL injection technique.
Description
SQL injection vulnerability in comments.php in LushiNews 1.01 and earlier allows remote authenticated users to inject arbitrary SQL commands via the id parameter.
Exploits (1)
This is a functional exploit for CVE-2007-0865, targeting a SQL injection vulnerability in LushiNews <= 1.01 via the 'comments.php' file. It extracts user credentials (username, password, email) from the database using a UNION-based SQL injection technique.