Exploitation Summary
EIP tracks 3 public exploits for CVE-2008-2334. PoCs published by U238.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in Philboard 0.5 by injecting a UNION-based query to extract user credentials from the database. The PoC provides a direct URL with malicious SQL payload to exploit the vulnerability.
Description
Multiple SQL injection vulnerabilities in W1L3D4 Philboard 0.5 allow remote attackers to execute arbitrary SQL commands via the (1) forumid parameter to (a) admin/philboard_admin-forumedit.asp, (b) admin/philboard_admin-forum.asp, and (c) W1L3D4_foruma_yeni_konu_ac.asp; the (2) id parameter to (d) W1L3D4_konuoku.asp and (e) W1L3D4_konuya_mesaj_yaz.asp; and the (3) topic parameter to W1L3D4_konuya_mesaj_yaz.asp, different vectors than CVE-2008-1939, CVE-2007-2641, and CVE-2007-0920. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Exploits (3)
This exploit demonstrates a SQL injection vulnerability in Philboard 0.5 by injecting a UNION-based query to extract user credentials from the database. The PoC provides a direct URL with malicious SQL payload to exploit the vulnerability.
This exploit demonstrates a SQL injection vulnerability in Philboard 0.5 by injecting a UNION-based query to extract data from the 'users' table. The PoC provides a direct URL with malicious input to exploit the vulnerability.
This exploit demonstrates a SQL injection vulnerability in Philboard 0.5 by injecting a UNION-based query to extract username and password from the users table. The attack leverages insufficient input sanitization in the forumid parameter.