CVE-2008-4606
IP Reg <= 0.4 - SQL Injection via location_id or vlan_id Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-4606. PoCs published by JosS.
AI-analyzed exploit summary This exploit demonstrates SQL injection vulnerabilities in IP Reg <= 0.4, specifically in multiple PHP files where user input is directly interpolated into SQL queries without sanitization. The PoC includes payloads to extract user credentials via UNION-based SQLi.
Description
Multiple SQL injection vulnerabilities in IP Reg 0.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) location_id parameter to locationdel.php and (2) vlan_id parameter to vlanedit.php. NOTE: the vlanview.php and vlandel.php vectors are already covered by CVE-2007-6579.
Exploits (1)
This exploit demonstrates SQL injection vulnerabilities in IP Reg <= 0.4, specifically in multiple PHP files where user input is directly interpolated into SQL queries without sanitization. The PoC includes payloads to extract user credentials via UNION-based SQLi.