CVE-2008-1425
Easy-Clanpage 2.2 - SQL Injection via Gallery Module id Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2008-1425. PoCs published by Easy Laster, n3w7u.
AI-analyzed exploit summary This Perl script exploits a SQL injection vulnerability in Easy-Clanpage <= v2.1 by injecting a UNION-based query to extract user credentials (password hashes) from the `ecp_user` table. The exploit constructs a malicious URL and uses LWP::Simple to fetch the response, parsing the password hash from the output.
Description
SQL injection vulnerability in index.php in the gallery module in Easy-Clanpage 2.2 allows remote attackers to execute arbitrary SQL commands via the id parameter in a kate action.
Exploits (2)
This Perl script exploits a SQL injection vulnerability in Easy-Clanpage <= v2.1 by injecting a UNION-based query to extract user credentials (password hashes) from the `ecp_user` table. The exploit constructs a malicious URL and uses LWP::Simple to fetch the response, parsing the password hash from the output.
This exploit demonstrates a SQL injection vulnerability in Easy-Clanpage v2.2's gallery module. The PoC provides a crafted URL that extracts user credentials from the database via a UNION-based SQL injection.