CVE-2008-3554

Discuz! 6.0.1 - SQL Injection via searchid Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-3554. PoCs published by james.

AI-analyzed exploit summary This exploit targets a SQL injection vulnerability in Discuz! 6.0.1 by injecting a malicious query into the search parameter to retrieve user passwords. It sends a crafted POST request to the target server to extract password hashes from the database.

Description

SQL injection vulnerability in index.php in Discuz! 6.0.1 allows remote attackers to execute arbitrary SQL commands via the searchid parameter in a search action.

Exploits (1)

exploitdb WORKING POC VERIFIED
by james · phpwebappsphp
https://www.exploit-db.com/exploits/6214

This exploit targets a SQL injection vulnerability in Discuz! 6.0.1 by injecting a malicious query into the search parameter to retrieve user passwords. It sends a crafted POST request to the target server to extract password hashes from the database.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: Discuz! 6.0.1
No auth needed
Prerequisites: PHP >= 5.0 · MySQL >= 4.1 · Network access to the target server
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/30583
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/44251
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/6214

Scores

EPSS 0.0100
EPSS Percentile 58.2%

Details

CWE
CWE-89
Status published
Products (1)
comsenz/discuz 6.0.1
Published Aug 08, 2008
Tracked Since Feb 18, 2026