CVE-2007-1931

SmodCMS < 2.10 - SQL Injection via Slownik Module ssid Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-1931. PoCs published by Kacper.

AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in SmodCMS <= 2.10, specifically targeting the 'Slownik ssid' parameter to extract admin credentials (name, surname, email, and password) via UNION-based SQLi.

Description

SQL injection vulnerability in index.php in the slownik module in SmodCMS 2.10 and earlier allows remote attackers to execute arbitrary SQL commands via the ssid parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Kacper · phpwebappsphp
https://www.exploit-db.com/exploits/3679

This exploit demonstrates a SQL injection vulnerability in SmodCMS <= 2.10, specifically targeting the 'Slownik ssid' parameter to extract admin credentials (name, surname, email, and password) via UNION-based SQLi.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: SmodCMS <= 2.10
No auth needed
Prerequisites: Target must be running SmodCMS <= 2.10 with the 'Slownik' module enabled
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/33477
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/1299
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/37395
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/3679

Scores

EPSS 0.0103
EPSS Percentile 59.1%

Details

Status published
Products (1)
smodcms/smodcms < 2.10
Published Apr 10, 2007
Tracked Since Feb 18, 2026