Exploitation Summary
EIP tracks 1 public exploit for CVE-2007-1548. PoCs published by Ivan Fratric.
AI-analyzed exploit summary This exploit demonstrates an SQL injection vulnerability in Web Wiz Forums by injecting a malicious SQL query into the 'name' parameter. The query extracts user credentials (username, password, and salt) from the 'tblauthor' table.
Description
SQL injection vulnerability in functions/functions_filters.asp in Web Wiz Forums before 8.05a (MySQL version) does not properly filter certain characters in SQL commands, which allows remote attackers to execute arbitrary SQL commands via \"' (backslash double-quote quote) sequences, which are collapsed into \'', as demonstrated via the name parameter to forum/pop_up_member_search.asp.
Exploits (1)
This exploit demonstrates an SQL injection vulnerability in Web Wiz Forums by injecting a malicious SQL query into the 'name' parameter. The query extracts user credentials (username, password, and salt) from the 'tblauthor' table.