Exploitation Summary
EIP tracks 1 public exploit for CVE-2007-4522. PoCs published by Nagendra Kumar G.
AI-analyzed exploit summary The provided text describes SQL injection and HTML injection vulnerabilities in Ripe Website Manager versions prior to 0.8.10. It includes a basic example of an SQL injection attack vector but lacks executable exploit code.
Description
Multiple SQL injection vulnerabilities in Ripe Website Manager 0.8.9 and earlier allow remote authenticated users to execute arbitrary SQL commands via one or more of the following vectors: the (1) id parameter to (a) pages/delete_page.php, (b) navigation/delete_menu.php, and (c) navigation/delete_item.php in admin/; the (2) menu_id, (3) name, (3) page_id, and (4) url parameters in (d) admin/navigation/do_new_item.php; the (5) new_menuname parameter in (e) admin/navigation/do_new_nav.php; and (6) area1, name, and url parameters to (f) admin/pages/do_new_page.php. NOTE: some vectors might be reachable through the url and name parameters to (g) admin/navigation/new_nav_item.php. NOTE: the original disclosure does not precisely state which vectors are associated with SQL injection versus XSS.
Exploits (1)
The provided text describes SQL injection and HTML injection vulnerabilities in Ripe Website Manager versions prior to 0.8.10. It includes a basic example of an SQL injection attack vector but lacks executable exploit code.