CVE-2008-3580

Qsoft K-Links - SQL Injection via id Parameter or PATH_INFO

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-3580. PoCs published by Corwin.

AI-analyzed exploit summary This exploit demonstrates SQL injection and XSS vulnerabilities in K-Links Directory Platinum. The SQLi allows retrieval of admin credentials, while the XSS is a passive reflected vulnerability.

Description

Multiple SQL injection vulnerabilities in Qsoft K-Links allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to visit.php, or the PATH_INFO to the default URI under (2) report/, (3) addreview/, or (4) refer/.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Corwin · textwebappsphp

https://www.exploit-db.com/exploits/6192

View Code ZIP pw:eip

This exploit demonstrates SQL injection and XSS vulnerabilities in K-Links Directory Platinum. The SQLi allows retrieval of admin credentials, while the XSS is a passive reflected vulnerability.

Classification

Working Poc 90%

Attack Type

Sqli, Xss

Complexity

Trivial

Reliability

Reliable

Target: K-Links Directory Platinum (All versions)

No auth needed

Prerequisites: Target running K-Links Directory Platinum · Access to vulnerable endpoints

MITRE ATT&CK