CVE-2008-7153

This exploit leverages a SQL injection vulnerability in Docebo Suite <= 3.5.0.3 via the Accept-Language header to extract admin credentials. It performs a brute-force attack to retrieve the username and password hash by checking the response for a specific date format.

This exploit leverages a SQL injection vulnerability in Docebo's autoDetectRegion() function via the HTTP_ACCEPT_LANGUAGE header to inject PHP code into a file using INTO DUMPFILE, achieving remote command execution. It includes path disclosure and a reverse shell mechanism.