CVE-2009-1066

Pixie CMS 1.01a - SQL Injection via Referer HTTP Header

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-1066. PoCs published by Justin Keane.

AI-analyzed exploit summary This writeup details multiple vulnerabilities in Pixie CMS, including XSS via the 'x' parameter in blog URLs and SQL injection via the 'Referer' header. The XSS allows redirection or arbitrary script execution, while the SQL injection can manipulate the 'pixie_log' table.

Description

SQL injection vulnerability in the referral function in admin/lib/lib_logs.php in Pixie CMS 1.01a allows remote attackers to execute arbitrary SQL commands via the Referer HTTP header in a request.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Justin Keane · textwebappsphp

https://www.exploit-db.com/exploits/8252

View Code ZIP pw:eip

This writeup details multiple vulnerabilities in Pixie CMS, including XSS via the 'x' parameter in blog URLs and SQL injection via the 'Referer' header. The XSS allows redirection or arbitrary script execution, while the SQL injection can manipulate the 'pixie_log' table.

Classification

Writeup 90%

Attack Type

Xss | Sqli

Complexity

Trivial

Reliability

Reliable

Target: Pixie CMS (version not specified)

No auth needed

Prerequisites: Access to a vulnerable Pixie CMS instance · Ability to manipulate HTTP headers and URL parameters

MITRE ATT&CK