CVE-2007-3313
Jasmine CMS 1.0 - SQL Injection via Login Username or News Item Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2007-3313. PoCs published by Silentz.
AI-analyzed exploit summary This exploit demonstrates SQL injection and remote code execution in Jasmine CMS 1.0 by injecting malicious PHP code into log files and leveraging a vulnerable parameter in plugin_manager.php. It also includes functionality to retrieve admin credentials via SQL injection.
Description
Multiple SQL injection vulnerabilities in Jasmine CMS 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the login_username parameter to login.php or (2) the item parameter to news.php.
Exploits (1)
This exploit demonstrates SQL injection and remote code execution in Jasmine CMS 1.0 by injecting malicious PHP code into log files and leveraging a vulnerable parameter in plugin_manager.php. It also includes functionality to retrieve admin credentials via SQL injection.