Exploitation Summary
EIP tracks 3 public exploits for CVE-2007-1974. PoCs published by ajann.
AI-analyzed exploit summary This Perl script exploits a blind SQL injection vulnerability in XOOPS Module Zmagazine 1.0 via the 'print.php' file. It crafts a malicious SQL query to extract admin credentials (username and password) from the 'xoops_users' table.
Description
SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section (aka WF-Sections) 1.0.1, as used in Xoops modules such as (1) Zmagazine 1.0, (2) Happy Linux XFsection 1.07 and earlier, and possibly other modules, allows remote attackers to execute arbitrary SQL commands via the articleid parameter to print.php.
Exploits (3)
This Perl script exploits a blind SQL injection vulnerability in XOOPS Module Zmagazine 1.0 via the 'print.php' file. It crafts a malicious SQL query to extract admin credentials (username and password) from the 'xoops_users' table.
This is a JavaScript-based blind SQL injection exploit targeting XOOPS Module XFsection <= 1.07. It automates the extraction of the admin password by testing ASCII values of characters in the password.
This Perl script exploits a blind SQL injection vulnerability in XOOPS Module WF-Section <= 1.01 via the 'articleid' parameter. It extracts admin credentials (username and password) from the 'xoops_users' table by injecting a UNION-based SQL query.