Exploitation Summary
EIP tracks 1 public exploit for CVE-2007-3646. PoCs published by Xenduer77.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in FlashGameScript <= 1.7 via the 'user' parameter in member.php. The PoC provides a crafted URL to extract admin credentials from the database.
Description
SQL injection vulnerability in index.php in FlashGameScript 1.7 and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter in a member action.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Xenduer77 · textwebappsphp
https://www.exploit-db.com/exploits/4161
This exploit demonstrates a SQL injection vulnerability in FlashGameScript <= 1.7 via the 'user' parameter in member.php. The PoC provides a crafted URL to extract admin credentials from the database.
Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target:
FlashGameScript <= 1.7
No auth needed
Prerequisites:
Target running FlashGameScript <= 1.7 · Access to the member.php endpoint
devstral-2 · analyzed Feb 16, 2026
Full analysis →
References (7)
Core 7
Core References
Various Sources x_refsource_confirm
http://flashgamescript.com/forum/viewtopic.php?t=425
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/25960
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/35293
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2007/2461
Exploit vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/24809
Exploit, Third Party Advisory exploit
x_refsource_exploit-db
https://www.exploit-db.com/exploits/4161
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/36297
Scores
EPSS
0.0156
EPSS Percentile
81.7%
Details
Status
published
Products (2)
flashgamescript/flashgamescript
1.5.4
flashgamescript/flashgamescript
1.7
Published
Jul 10, 2007
Tracked Since
Feb 18, 2026