CVE-2008-3918

This exploit demonstrates a SQL injection vulnerability in Ovidentia 6.6.5. The crafted URL injects a UNION-based SQL query to extract user credentials (nickname and password) from the 'bab_users' table.

The exploit demonstrates multiple stored and reflected XSS vulnerabilities, as well as a SQL injection flaw in Ovidentia 7.9.4. It includes HTTP request examples with malicious payloads that trigger the vulnerabilities.