CVE-2007-3687
RPG Inferno < 2.4 - Authenticated SQL Injection via id Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2007-3687. PoCs published by t0pP8uZz.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in RPG Inferno v2.4, allowing an attacker to retrieve admin credentials (username, password, and salt) from the database. The exploit requires authentication and uses a UNION-based SQL injection to extract data from the user table.
Description
SQL injection vulnerability in inferno.php in the Inferno Technologies RPG Inferno 2.4 and earlier, a vBulletin module, allows remote authenticated attackers to execute arbitrary SQL commands via the id parameter in a ScanMember do action.
Exploits (1)
This exploit demonstrates a SQL injection vulnerability in RPG Inferno v2.4, allowing an attacker to retrieve admin credentials (username, password, and salt) from the database. The exploit requires authentication and uses a UNION-based SQL injection to extract data from the user table.