CVE-2007-1363
dropafew < 0.2 - SQL Injection via id or calories Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2007-1363. PoCs published by Alexander Klink.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in DropAFew 0.2 by sending a malicious POST request to delete entries from the foodfacts table. The payload uses a simple OR-based SQLi to bypass authentication and delete records.
Description
Multiple SQL injection vulnerabilities in DropAFew before 0.2.1 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in the delete action in (a) search.php or (b) search-pda.php, or the (2) calories parameter in a save action in editlogcal.php.
Exploits (2)
This exploit demonstrates a SQL injection vulnerability in DropAFew 0.2 by sending a malicious POST request to delete entries from the foodfacts table. The payload uses a simple OR-based SQLi to bypass authentication and delete records.
This exploit demonstrates a SQL injection vulnerability in DropAFew 0.2 by manipulating the 'id' parameter in a POST request to the 'editlogcal.php' endpoint. The payload uses a SQL comment to bypass input validation and potentially manipulate the database query.