CVE-2007-1364
dropafew < 0.2 - Arbitrary User Creation and Information Disclosure
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2007-1364. PoCs published by Alexander Klink.
AI-analyzed exploit summary This exploit demonstrates SQL injection vulnerabilities in DropAFew 0.2 by creating a new user account via a crafted POST request. The lack of input sanitization allows arbitrary SQL commands to be executed.
Description
DropAFew before 0.2.1 does not require authorization for certain privileged actions, which allows remote attackers to (1) view the logged calorie information of arbitrary users via the id parameter in editlogcal.php, (2) add arbitrary links via links.php, or (3) create arbitrary users via newaccount2.php.
Exploits (1)
This exploit demonstrates SQL injection vulnerabilities in DropAFew 0.2 by creating a new user account via a crafted POST request. The lack of input sanitization allows arbitrary SQL commands to be executed.