CVE-2007-3563

AV Arcade 2.1b - SQL Injection via id Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-3563. PoCs published by Kw3[R]Ln.

AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in AV Arcade 2.1b via the 'id' parameter in includes/view_page.php. The PoC extracts admin credentials (username and password) from the 'ava_users' table using a UNION-based SQLi attack.

Description

SQL injection vulnerability in includes/view_page.php in AV Arcade 2.1b allows remote attackers to execute arbitrary SQL commands via the id parameter in a view_page action to index.php.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Kw3[R]Ln · textwebappsphp

https://www.exploit-db.com/exploits/4138

View Code ZIP pw:eip

This exploit demonstrates a SQL injection vulnerability in AV Arcade 2.1b via the 'id' parameter in includes/view_page.php. The PoC extracts admin credentials (username and password) from the 'ava_users' table using a UNION-based SQLi attack.

Classification

Working Poc 90%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: AV Arcade 2.1b

No auth needed

Prerequisites: Target application must be AV Arcade 2.1b · SQL injection vulnerability must be unpatched

MITRE ATT&CK