CVE-2008-6618
ClassSystem 2.3 - SQL Injection via teacher_id and message_id Parameters
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2008-6618. PoCs published by Unohope.
AI-analyzed exploit summary The exploit demonstrates a SQL injection vulnerability in ClassSystem by manipulating the 'message_id' parameter in a URL to extract teacher credentials from the database. It leverages a UNION-based SQLi technique to bypass input validation.
Description
Multiple SQL injection vulnerabilities in ClassSystem 2.3 allow remote attackers to execute arbitrary SQL commands via the teacher_id parameter in (1) class/HomepageMain.php and (2) class/HomepageTop.php, and (3) the message_id parameter in class/MessageReply.php.
Exploits (3)
The exploit demonstrates a SQL injection vulnerability in ClassSystem by manipulating the 'message_id' parameter in a URL to extract teacher credentials from the database. It leverages a UNION-based SQLi technique to bypass input validation.
This exploit demonstrates a SQL injection vulnerability in ClassSystem by injecting a UNION-based query to extract teacher credentials. The vulnerability arises from insufficient input sanitization in the 'teacher_id' parameter.
This exploit demonstrates a SQL injection vulnerability in ClassSystem by injecting a UNION-based query to extract teacher credentials (account and password) from the database. The vulnerability arises from insufficient input sanitization in the 'teacher_id' parameter.