Exploitation Summary
EIP tracks 2 public exploits for CVE-2007-6080. PoCs published by DeltahackingTEAM, BugReport.IR.
AI-analyzed exploit summary This exploit demonstrates an SQL injection vulnerability in bcoos 1.0.13 by injecting a UNION-based query to extract user passwords from the database. The attack leverages unsanitized input in the 'bid' parameter of the click.php script.
Description
SQL injection vulnerability in modules/banners/click.php in the banners module for bcoos 1.0.10 allows remote attackers to execute arbitrary SQL commands via the bid parameter. NOTE: it was later reported that 1.0.13 is also affected.
Exploits (2)
This exploit demonstrates an SQL injection vulnerability in bcoos 1.0.13 by injecting a UNION-based query to extract user passwords from the database. The attack leverages unsanitized input in the 'bid' parameter of the click.php script.
This is a technical writeup detailing multiple vulnerabilities in Bcoos CMS, including Local File Inclusion (LFI) and SQL Injection. It provides code snippets, root cause analysis, and proof-of-concept URLs for exploitation.