Exploitation Summary
EIP tracks 1 public exploit for CVE-2009-1033. PoCs published by girex.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in DeluxeBB 1.3 and prior, allowing an attacker to retrieve all usernames and password hashes from the database without authentication. The vulnerability arises from improper handling of the 'order' parameter in misc.php, enabling arbitrary SQL queries.
Description
SQL injection vulnerability in misc.php in DeluxeBB 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the qorder parameter, a different vector than CVE-2005-2989 and CVE-2006-2503.
Exploits (1)
This exploit demonstrates a SQL injection vulnerability in DeluxeBB 1.3 and prior, allowing an attacker to retrieve all usernames and password hashes from the database without authentication. The vulnerability arises from improper handling of the 'order' parameter in misc.php, enabling arbitrary SQL queries.