Exploitation Summary
EIP tracks 1 public exploit for CVE-2008-2029. PoCs published by girex.
AI-analyzed exploit summary This exploit demonstrates multiple vulnerabilities in miniBB 2.2, including Full Path Disclosure, Cross-Site Scripting (XSS), and Remote SQL Injection. The SQL Injection PoC retrieves admin credentials or sensitive files via UNION-based attacks, requiring register_globals to be enabled.
Description
Multiple SQL injection vulnerabilities in (1) setup_mysql.php and (2) setup_options.php in miniBB 2.2 and possibly earlier, when register_globals is enabled, allow remote attackers to execute arbitrary SQL commands via the xtr parameter in a userinfo action to index.php.
Exploits (1)
This exploit demonstrates multiple vulnerabilities in miniBB 2.2, including Full Path Disclosure, Cross-Site Scripting (XSS), and Remote SQL Injection. The SQL Injection PoC retrieves admin credentials or sensitive files via UNION-based attacks, requiring register_globals to be enabled.