CVE-2008-1843

W2B DatingClub - SQL Injection via browse.php age_to Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-1843. PoCs published by The-0utl4w.

AI-analyzed exploit summary This exploit demonstrates an SQL injection vulnerability in W2B Dating Club by injecting a UNION-based SQL query to extract user credentials (username and password) from the 'users' table. The vulnerability arises from insufficient sanitization of the 'age_to' parameter in the browse.php script.

Description

SQL injection vulnerability in browse.php in W2B DatingClub (aka Dating Club) allows remote attackers to execute arbitrary SQL commands via the age_to parameter in a browsebyCat action.

Exploits (1)

exploitdb WORKING POC VERIFIED

by The-0utl4w · textwebappsphp

https://www.exploit-db.com/exploits/31637

View Code ZIP pw:eip

This exploit demonstrates an SQL injection vulnerability in W2B Dating Club by injecting a UNION-based SQL query to extract user credentials (username and password) from the 'users' table. The vulnerability arises from insufficient sanitization of the 'age_to' parameter in the browse.php script.

Classification

Working Poc 90%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: W2B Dating Club (unknown version)

No auth needed

Prerequisites: Access to the vulnerable browse.php endpoint

MITRE ATT&CK