CVE-2007-2556
Nuked-klaN 1.7.6 - SQL Injection via X-Forwarded-For Header
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2007-2556. PoCs published by Charles Fol, DarkFig.
AI-analyzed exploit summary This exploit targets Nuked-klaN <= 1.7.7 and <= SP4.4, leveraging SQL injection via HTTP_REFERER and X-Forwarded-For headers to extract admin credentials or spawn a shell. It uses blind SQL injection techniques and requires stats to be enabled.
Description
SQL injection vulnerability in Nuked-klaN 1.7.6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For (X_FORWARDED_FOR) HTTP header, as demonstrated by a request to the /nk/ URI.
Exploits (2)
This exploit targets Nuked-klaN <= 1.7.7 and <= SP4.4, leveraging SQL injection via HTTP_REFERER and X-Forwarded-For headers to extract admin credentials or spawn a shell. It uses blind SQL injection techniques and requires stats to be enabled.
This exploit targets CVE-2007-2556, a SQL injection vulnerability in Nuked-klaN 1.7.6, allowing remote code execution via crafted HTTP headers and file upload manipulation. It leverages the PhpSploit class to automate the attack, extract credentials, and establish a shell.