CVE-2008-6614

Implied By Design Micro CMS 3.5 - SQL Injection via Login Username or Password Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-6614. PoCs published by learn3r hacker.

AI-analyzed exploit summary This is a writeup describing two vulnerabilities in Micro CMS: a file inclusion vulnerability requiring register globals to be enabled and an SQL injection login bypass. No actual exploit code is provided.

Description

Multiple SQL injection vulnerabilities in microcms-admin-login.php in Implied By Design (IBD) Micro CMS 3.5 (aka 0.3.5) allow remote attackers to execute arbitrary SQL commands via (1) the administrators_username parameter (aka the Username field) or (2) the administrators_pass parameter (aka the Password field).

Exploits (1)

exploitdb WRITEUP VERIFIED

by learn3r hacker · textwebappsphp

https://www.exploit-db.com/exploits/9699

View Code ZIP pw:eip

This is a writeup describing two vulnerabilities in Micro CMS: a file inclusion vulnerability requiring register globals to be enabled and an SQL injection login bypass. No actual exploit code is provided.

Classification

Writeup 90%

Attack Type

Sqli | Auth Bypass

Complexity

Trivial

Reliability

Theoretical

Target: Micro CMS v3.5 or lower

No auth needed

Prerequisites: register globals enabled for file inclusion · valid username or SQLi payload for login bypass

MITRE ATT&CK