CVE-2008-7153
Docebo < 3.5.0.3 - SQL Injection via Accept-Language HTTP Header
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2008-7153. PoCs published by rgod, EgiX.
AI-analyzed exploit summary This exploit leverages a SQL injection vulnerability in Docebo Suite <= 3.5.0.3 via the Accept-Language header to extract admin credentials. It performs a brute-force attack to retrieve the username and password hash by checking the response for a specific date format.
Description
SQL injection vulnerability in the autoDetectRegion function in doceboCore/lib/lib.regset.php in Docebo 3.5.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Accept-Language HTTP header. NOTE: this can be leveraged to execute arbitrary PHP code using the INTO DUMPFILE command.
Exploits (2)
This exploit leverages a SQL injection vulnerability in Docebo Suite <= 3.5.0.3 via the Accept-Language header to extract admin credentials. It performs a brute-force attack to retrieve the username and password hash by checking the response for a specific date format.
This exploit leverages a SQL injection vulnerability in Docebo's autoDetectRegion() function via the HTTP_ACCEPT_LANGUAGE header to inject PHP code into a file using INTO DUMPFILE, achieving remote command execution. It includes path disclosure and a reverse shell mechanism.