CVE-2007-6137

Content Injector <1.52 - SQL Injection

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-6137. PoCs published by S.W.A.T..

AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in Content Injector v1.52, allowing an attacker to extract admin credentials (username and MD5 password) via a crafted UNION-based SQL query.

Description

SQL injection vulnerability in news.php in Content Injector 1.52 allows remote attackers to execute arbitrary SQL commands via the cat parameter to index.php. NOTE: some of these details are obtained from third party information.

Exploits (1)

exploitdb WORKING POC VERIFIED

by S.W.A.T. · textwebappsphp

https://www.exploit-db.com/exploits/4645

View Code ZIP pw:eip

This exploit demonstrates a SQL injection vulnerability in Content Injector v1.52, allowing an attacker to extract admin credentials (username and MD5 password) via a crafted UNION-based SQL query.

Classification

Working Poc 90%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: Content Injector v1.52

No auth needed

Prerequisites: Target application must be running Content Injector v1.52 · SQL injection endpoint must be accessible

MITRE ATT&CK