CVE-2008-4350

vbLOGIX Tutorial Script < 1.0 - SQL Injection via cat_id Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-4350. PoCs published by FIREH4CK3R.

AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in vbLOGIX Tutorial Script v1.0 via the 'cat_id' parameter. The PoC extracts user credentials (username and password) from the database using a UNION-based SQL injection.

Description

SQL injection vulnerability in main.php in vbLOGIX Tutorial Script 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action.

Exploits (1)

exploitdb WORKING POC VERIFIED

by FIREH4CK3R · textwebappsphp

https://www.exploit-db.com/exploits/6446

View Code ZIP pw:eip

This exploit demonstrates a SQL injection vulnerability in vbLOGIX Tutorial Script v1.0 via the 'cat_id' parameter. The PoC extracts user credentials (username and password) from the database using a UNION-based SQL injection.

Classification

Working Poc 90%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: vbLOGIX Tutorial Script v1.0

No auth needed

Prerequisites: Target application must be running vbLOGIX Tutorial Script v1.0 · The 'main.php' endpoint must be accessible

MITRE ATT&CK