CVE-2008-2446

Web Group Communication Center < 1.0.3_prerelease1 - Authenticated SQL Injection via Multiple Parameters

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-2446. PoCs published by myvx.

AI-analyzed exploit summary This exploit demonstrates XSS and SQL injection vulnerabilities in Web Group Communication Center. The XSS payload bypasses filters via URL encoding, while the SQLi extracts user credentials from the database.

Description

Multiple SQL injection vulnerabilities in Web Group Communication Center (WGCC) 1.0.3 PreRelease 1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) userid parameter to (a) profile.php in a "show moreinfo" action; the (2) bildid parameter to (b) picturegallery.php in a shownext action; the (3) id parameter to (c) filebase.php in a freigeben action, (d) schedule.php in a del action, and (e) profile.php in an observe action; and the (4) pmid parameter in a delete action and (5) folderid parameter in a showfolder action to (f) message.php.

Exploits (1)

exploitdb WORKING POC VERIFIED

by myvx · textwebappsphp

https://www.exploit-db.com/exploits/5606

View Code ZIP pw:eip

This exploit demonstrates XSS and SQL injection vulnerabilities in Web Group Communication Center. The XSS payload bypasses filters via URL encoding, while the SQLi extracts user credentials from the database.

Classification

Working Poc 90%

Attack Type

Xss | Sqli | Info Leak

Complexity

Trivial

Reliability

Reliable

Target: Web Group Communication Center <= 1.0.3 PreRelease #1

Auth required

Prerequisites: Target application installed · Network access to the application · Valid credentials for SQLi

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059.007 - JavaScript T1505 - Server Software Component

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4

Core References

Exploit, Third Party Advisory exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/5606

Exploit vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/29188

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/42385

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/30235

Scores

EPSS 0.0054

EPSS Percentile 67.9%

Details

CWE

CWE-89

Status published

Products (1)

wgcc/web_group_communication_center < 1.0.3_prerelease1

Published May 27, 2008

Tracked Since Feb 18, 2026