Exploitation Summary
EIP tracks 1 public exploit for CVE-2008-6146. PoCs published by StAkeR.
AI-analyzed exploit summary This Perl script exploits a blind SQL injection vulnerability in DeluxeBB <= 1.2 by abusing the PM (Private Message) functionality to extract user password hashes via time-based delays. It requires authentication and leverages the benchmark function to infer character values.
Description
SQL injection vulnerability in pm.php in DeluxeBB 1.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via a delete##### parameter in a Delete action, a different vector than CVE-2005-2989.
Exploits (1)
This Perl script exploits a blind SQL injection vulnerability in DeluxeBB <= 1.2 by abusing the PM (Private Message) functionality to extract user password hashes via time-based delays. It requires authentication and leverages the benchmark function to infer character values.