CVE-2008-6798

Pre Projects Pre Real Estate Listings - SQL Injection via Username or Password Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-6798. PoCs published by BackDoor.

AI-analyzed exploit summary This exploit demonstrates an authentication bypass via SQL injection in the login form and an unrestricted file upload vulnerability in the profile editing functionality of Pre Real Estate Listings. The SQL injection allows bypassing authentication, and the file upload can be abused to achieve remote code execution.

Description

Multiple SQL injection vulnerabilities in login.php in Pre Projects Pre Real Estate Listings allow remote attackers to execute arbitrary SQL commands via (1) the us parameter (aka the Username field) or (2) the ps parameter (aka the Password field).

Exploits (1)

exploitdb WORKING POC VERIFIED

by BackDoor · textwebappsphp

https://www.exploit-db.com/exploits/7094

View Code ZIP pw:eip

This exploit demonstrates an authentication bypass via SQL injection in the login form and an unrestricted file upload vulnerability in the profile editing functionality of Pre Real Estate Listings. The SQL injection allows bypassing authentication, and the file upload can be abused to achieve remote code execution.

Classification

Working Poc 90%

Attack Type

Sqli | Auth Bypass | Rce

Complexity

Trivial

Reliability

Reliable

Target: Pre Real Estate Listings (version not specified)

No auth needed

Prerequisites: access to the login page · file upload functionality enabled

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1505 - Server Software Component

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3

Core References

Exploit, Third Party Advisory exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/7094

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2008/3121

Exploit vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/32134

Scores

EPSS 0.0097

EPSS Percentile 57.2%

Details

CWE

CWE-89

Status published

Products (1)

preprojects/pre_real_estate_listings

Published May 07, 2009

Tracked Since Feb 18, 2026