CVE-2007-3000
PHP JackKnife - SQL Injection via iCategoryUnq or iSearchID Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2007-3000. PoCs published by laurent gaffie.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in PHP JackKnife by injecting a UNION-based query to extract login credentials from the 'Accounts' table. The attack leverages improper input validation in the 'iSearchID' parameter.
Description
Multiple SQL injection vulnerabilities in PHP JackKnife (PHPJK) allow remote attackers to execute arbitrary SQL commands via (1) the iCategoryUnq parameter to G_Display.php or (2) the iSearchID parameter to Search/DisplayResults.php.
Exploits (2)
This exploit demonstrates a SQL injection vulnerability in PHP JackKnife by injecting a UNION-based query to extract login credentials from the 'Accounts' table. The attack leverages improper input validation in the 'iSearchID' parameter.
This exploit demonstrates SQL injection vulnerabilities in PHP JackKnife, allowing attackers to extract sensitive data such as passwords and configuration files via crafted UNION-based SQL queries.