CVE-2007-5646

Simple Machines Forum 1.1.3 - SQL Injection via Userspec Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-5646. PoCs published by Michael Brooks.

AI-analyzed exploit summary This Perl script exploits a blind SQL injection vulnerability in Simple Machines Forum (SMF) 1.1.3, allowing an attacker to extract password hashes or install a backdoor via SQL queries. It uses multi-threading and binary search techniques to efficiently extract data.

Description

SQL injection vulnerability in Sources/Search.php in Simple Machines Forum (SMF) 1.1.3, when MySQL 5 is used, allows remote attackers to execute arbitrary SQL commands via the userspec parameter in a search2 action to index.php.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Michael Brooks · perlwebappsphp

https://www.exploit-db.com/exploits/4547

View Code ZIP pw:eip

This Perl script exploits a blind SQL injection vulnerability in Simple Machines Forum (SMF) 1.1.3, allowing an attacker to extract password hashes or install a backdoor via SQL queries. It uses multi-threading and binary search techniques to efficiently extract data.

Classification

Working Poc 95%

Attack Type

Sqli

Complexity

Moderate

Reliability

Reliable

Target: Simple Machines Forum (SMF) 1.1.3

No auth needed

Prerequisites: Target running SMF 1.1.3 · Network access to the target

MITRE ATT&CK