CVE-2008-6438
MacGuru BLOG Engine Plugin 2.1.4-2.2 - SQL Injection via uid Parameter
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2008-6438. PoCs published by ZoRLu, Virangar Security.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in the e107 Plugin macgurublog_menu via the 'uid' parameter. It allows an attacker to extract user credentials (username and password) from the e107_user table.
Description
SQL injection vulnerability in macgurublog_menu/macgurublog.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows remote attackers to execute arbitrary SQL commands via the uid parameter, a different vector than CVE-2008-2455. NOTE: it was later reported that 2.1.4 is also affected.
Exploits (4)
This exploit demonstrates a SQL injection vulnerability in the e107 Plugin macgurublog_menu via the 'uid' parameter. It allows an attacker to extract user credentials (username and password) from the e107_user table.
This Perl script exploits a SQL injection vulnerability in e107 Plugin BLOG Engine v2.2 to extract admin credentials (username and password hash) from the database. It constructs a malicious SQL query via URL manipulation and parses the response to extract sensitive information.
This Perl script exploits a blind SQL injection vulnerability in e107 Plugin BLOG Engine v2.2 to extract the admin user's password hash. It uses a brute-force approach to determine each character of the MD5 hash by checking responses from the target server.
This is a writeup describing a blind SQL injection vulnerability in the e107 Plugin BLOG Engine v2.2. It explains the vulnerability in macgurublog.php where the 'uid' parameter is directly used in a SQL query without sanitization, allowing for blind SQL injection attacks.