CVE-2007-5016
OneCMS 2.4 - SQL Injection via userreviews.php abc Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2007-5016. PoCs published by str0ke.
AI-analyzed exploit summary This Perl script exploits an SQL injection vulnerability in OneCMS v2.4 via the 'abc' parameter in userreviews.php. It extracts username and password hashes from the database when magic_quotes_gpc is disabled.
Description
SQL injection vulnerability in userreviews.php in OneCMS 2.4 allows remote attackers to execute arbitrary SQL commands via the abc parameter.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by str0ke · perlwebappsphp
https://www.exploit-db.com/exploits/4433
This Perl script exploits an SQL injection vulnerability in OneCMS v2.4 via the 'abc' parameter in userreviews.php. It extracts username and password hashes from the database when magic_quotes_gpc is disabled.
Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target:
OneCMS v2.4
No auth needed
Prerequisites:
magic_quotes_gpc = off · target URL
devstral-2 · analyzed Feb 16, 2026
Full analysis →
References (5)
Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/36705
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/26902
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/37163
Exploit vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/25741
Exploit, Third Party Advisory exploit
x_refsource_exploit-db
https://www.exploit-db.com/exploits/4433
Scores
EPSS
0.0102
EPSS Percentile
58.8%
Details
CWE
CWE-89
Status
published
Products (1)
insane_visions/onecms
2.4
Published
Sep 20, 2007
Tracked Since
Feb 18, 2026