CVE-2007-3196

vBSupport Integrated Ticket System 3.x.x - SQL Injection via Ticket ID Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-3196. PoCs published by rUnViRuS.

AI-analyzed exploit summary The provided text describes an SQL injection vulnerability in vBSupport, where the 'ticketid' parameter in the 'showticket' action is not properly sanitized. This allows an attacker to manipulate SQL queries and perform unauthorized actions on the database.

Description

SQL injection vulnerability in vBSupport.php in vSupport Integrated Ticket System 3.x.x allows remote attackers to execute arbitrary SQL commands via the ticketid parameter in a showticket action.

Exploits (1)

exploitdb WRITEUP VERIFIED

by rUnViRuS · textwebappsphp

https://www.exploit-db.com/exploits/30168

View Code ZIP pw:eip

The provided text describes an SQL injection vulnerability in vBSupport, where the 'ticketid' parameter in the 'showticket' action is not properly sanitized. This allows an attacker to manipulate SQL queries and perform unauthorized actions on the database.

Classification

Writeup 90%

Attack Type

Sqli

Complexity

Trivial

Reliability

Theoretical

Target: vBSupport (version not specified)

No auth needed

Prerequisites: Access to the vulnerable vBSupport.php endpoint

MITRE ATT&CK