CVE-2008-4895
YourFreeWorld Downline Builder - SQL Injection via tr.php id Parameter
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2008-4895. PoCs published by Hussin X.
AI-analyzed exploit summary The exploit demonstrates an SQL injection vulnerability in Downline Builder Pro by injecting a UNION-based query to extract database information (user, version, database name). The payload is appended to the 'id' parameter in the 'tr.php' script.
Description
SQL injection vulnerability in tr.php in YourFreeWorld Downline Builder allows remote attackers to execute arbitrary SQL commands via the id parameter.
Exploits (3)
The exploit demonstrates an SQL injection vulnerability in Downline Builder Pro by injecting a UNION-based query to extract database information (user, version, database name). The payload is appended to the 'id' parameter in the 'tr.php' script.
This is a functional SQL injection exploit for Downline Builder, leveraging a UNION-based attack to extract admin credentials from the 'adminsettings' table. The payload concatenates username and password fields with colons for easy extraction.
This exploit demonstrates a SQL injection vulnerability in Banner Management script via the 'id' parameter in tr.php. The payload uses a UNION-based SQLi to extract database information including user, version, and database name.