Exploitation Summary
EIP tracks 2 public exploits for CVE-2007-3394. PoCs published by laurent gaffie.
AI-analyzed exploit summary The exploit demonstrates SQL injection vulnerabilities in eNdonesia 8.4 by providing multiple crafted URLs that extract sensitive data such as passwords and file contents from the database.
Description
Multiple SQL injection vulnerabilities in eNdonesia 8.4 allow remote attackers to execute arbitrary SQL commands via the (1) artid parameter to mod.php in a viewarticle action (publisher mod) and the (2) bid parameter to banners.php in a click action. NOTE: the mod.php viewdisk and viewlink vectors are already covered by CVE-2006-6873.
Exploits (2)
The exploit demonstrates SQL injection vulnerabilities in eNdonesia 8.4 by providing multiple crafted URLs that extract sensitive data such as passwords and file contents from the database.
This exploit demonstrates a SQL injection vulnerability in eNdonesia 8.4 via the 'bid' parameter in banners.php. The PoC uses a UNION-based SQLi to extract password hashes from the 'authors' table.