CVE-2008-2197
Miniweb2 blog_writer 2.0 - SQL Injection via Historymonth Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2008-2197. PoCs published by HaCkeR_EgY.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in Miniweb 2.0's index.php, specifically in the 'historymonth' parameter. The PoC uses a UNION-based SQLi to extract admin credentials (user_id, username, password) from the 'admin_access' table.
Description
SQL injection vulnerability in the blogwriter module 2.0 for Miniweb allows remote attackers to execute arbitrary SQL commands via the historymonth parameter to index.php.
Exploits (2)
This exploit demonstrates a SQL injection vulnerability in Miniweb 2.0's index.php, specifically in the 'historymonth' parameter. The PoC uses a UNION-based SQLi to extract admin credentials (user_id, username, password) from the 'admin_access' table.
This exploit demonstrates an SQL injection vulnerability in Miniweb 2.0, allowing an attacker to bypass authentication by injecting 'union select 1#' into the username field, effectively granting admin access.