Exploitation Summary
EIP tracks 1 public exploit for CVE-2007-6579. PoCs published by MhZ91.
AI-analyzed exploit summary This exploit demonstrates multiple SQL injection vulnerabilities in Ip Reg v0.3, allowing an attacker to extract user credentials (username, password, and display name) from the database by manipulating the 'vlan_id' and other parameters in various PHP scripts.
Description
Multiple SQL injection vulnerabilities in Ip Reg 0.3 allow remote attackers to execute arbitrary SQL commands via the vlan_id parameter to (1) vlanview.php, (2) vlanedit.php, and (3) vlandel.php; the (4) assetclassgroup_id parameter to assetclassgroupview.php; the (5) subnet_id parameter to nodelist.php; and unspecified other vectors. NOTE: it was later reported that the vlanview.php and vlandel.php vectors are also in 0.4.
Exploits (1)
This exploit demonstrates multiple SQL injection vulnerabilities in Ip Reg v0.3, allowing an attacker to extract user credentials (username, password, and display name) from the database by manipulating the 'vlan_id' and other parameters in various PHP scripts.