CVE-2008-6970
UBB.threads < 7.3.1 - SQL Injection via Forum[] Array Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2008-6970. PoCs published by GulfTech Security, KyomaHooin.
AI-analyzed exploit summary This exploit demonstrates an SQL injection vulnerability in UBB.threads by manipulating the 'Forum[]' parameter to extract user passwords from the database. The payload uses UNION-based SQLi to bypass input sanitization and retrieve sensitive data.
Description
SQL injection vulnerability in dosearch.inc.php in UBB.threads 7.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the Forum[] array parameter.
Exploits (2)
This exploit demonstrates an SQL injection vulnerability in UBB.threads by manipulating the 'Forum[]' parameter to extract user passwords from the database. The payload uses UNION-based SQLi to bypass input sanitization and retrieve sensitive data.
This repository contains a functional shell script that exploits a blind SQL injection vulnerability in UBB.threads 7.3.1 via the dosearch.php endpoint. The script brute-forces the MD5 password hash for a given user ID by leveraging a parameter input validation flaw.