CVE-2007-6671

Instant Softwares Dating Site - SQL Injection

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-6671. PoCs published by Aria-Security Team.

AI-analyzed exploit summary This exploit demonstrates an SQL injection vulnerability in InstantSoftwares Dating Site by bypassing authentication via a crafted password field. The payload 'anything' OR 'x'='x' manipulates the SQL query to authenticate as any user, including 'Admin'.

Description

SQL injection vulnerability in login_form.asp in Instant Softwares Dating Site allows remote attackers to execute arbitrary SQL commands via the Password parameter, a different product than CVE-2006-6021. NOTE: some of these details are obtained from third party information.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Aria-Security Team · textwebappsasp

https://www.exploit-db.com/exploits/30963

View Code ZIP pw:eip

This exploit demonstrates an SQL injection vulnerability in InstantSoftwares Dating Site by bypassing authentication via a crafted password field. The payload 'anything' OR 'x'='x' manipulates the SQL query to authenticate as any user, including 'Admin'.

Classification

Working Poc 90%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: InstantSoftwares Dating Site (version not specified)

No auth needed

Prerequisites: Access to the login page of the vulnerable application

MITRE ATT&CK