CVE-2007-4210
LANAI CMS 1.2.14 - SQL Injection via FAQ, EZSHOPINGCART, or GALLERY Module Parameters
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2007-4210. PoCs published by k1tk4t.
AI-analyzed exploit summary This exploit demonstrates SQL injection vulnerabilities in la-nai CMS v1.2.14, specifically in the FAQ, EZSHOPINGCART, and GALLERY modules. It bypasses authentication by injecting SQL queries to extract user credentials from the database.
Description
Multiple SQL injection vulnerabilities in module.php in LANAI (la-nai) CMS 1.2.14 allow remote attackers to execute arbitrary SQL commands via (1) the mid parameter in an faqviewgroup action in the FAQ Modules, (2) the cid parameter in the EZSHOPINGCART Modules, or (3) the gid parameter in a view action in the GALLERY Modules.
Exploits (4)
This exploit demonstrates SQL injection vulnerabilities in la-nai CMS v1.2.14, specifically in the FAQ, EZSHOPINGCART, and GALLERY modules. It bypasses authentication by injecting SQL queries to extract user credentials from the database.
This exploit demonstrates a SQL injection vulnerability in LANAI CMS by manipulating the 'gid' parameter in a URL to extract user credentials from the database. The payload uses UNION-based SQLi to retrieve data from the 'tbl_ln_user' table.
This exploit demonstrates a SQL injection vulnerability in LANAI CMS by injecting a UNION-based SQL query to extract user credentials from the database. The PoC manipulates the 'mid' parameter in the URL to bypass authentication and retrieve sensitive data.
This exploit demonstrates a SQL injection vulnerability in LANAI CMS by manipulating the 'cid' parameter in a URL to extract user credentials via a UNION-based attack. The payload bypasses authentication and retrieves login-password pairs from the database.