Exploitation Summary
EIP tracks 2 public exploits for CVE-2009-0445. PoCs published by Mr.SQL, Mehmet Ince.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in DreamPics Builder via the 'fuseaction' parameter in index.php. The PoC uses a UNION-based SQLi to extract user credentials (username and password) from the 'users' table.
Description
SQL injection vulnerability in index.php in Dreampics Gallery Builder allows remote attackers to execute arbitrary SQL commands via the exhibition_id parameter in a gallery.viewPhotos action.
Exploits (2)
This exploit demonstrates a SQL injection vulnerability in DreamPics Builder via the 'fuseaction' parameter in index.php. The PoC uses a UNION-based SQLi to extract user credentials (username and password) from the 'users' table.
This PHP script exploits a blind SQL injection vulnerability in DreamPics Photo/Video Gallery by inferring database content through response length differences. It extracts admin credentials by brute-forcing character values via ASCII comparisons.