CVE-2008-2995
PHPEasyData 1.5.4 - SQL Injection via Annuaire Parameter or Admin Login Username
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2008-2995. PoCs published by Sylvain THUAL.
AI-analyzed exploit summary This exploit demonstrates SQL injection and XSS vulnerabilities in PHPEasyData 1.5.4 by injecting a UNION-based SQL query to extract user credentials from the database. The attack leverages unsanitized input in the 'annuaire' parameter.
Description
Multiple SQL injection vulnerabilities in PHPEasyData 1.5.4 allow remote attackers to execute arbitrary SQL commands via (1) the annuaire parameter to annuaire.php or (2) the username field in admin/login.php.
Exploits (2)
This exploit demonstrates SQL injection and XSS vulnerabilities in PHPEasyData 1.5.4 by injecting a UNION-based SQL query to extract user credentials from the database. The attack leverages unsanitized input in the 'annuaire' parameter.
The provided text describes SQL injection and XSS vulnerabilities in PHPEasyData 1.5.4, specifically detailing an authentication bypass via SQL injection in admin/login.php. It lacks executable exploit code but provides technical details for manual exploitation.