CVE-2009-1347

This exploit describes an authentication bypass vulnerability in chCounter 3.1.3, where using ' or = as the username and password allows unauthorized access. The exploit requires magic quotes to be disabled on the target system.

This is a detailed technical writeup describing an indirect SQL injection and XSS vulnerability in chCounter 3.1.1. The SQL injection occurs when a visitor manipulates the page title (e.g., via WordPress search parameter), which is stored in the database and later executed when the admin views visitor details. The XSS vulnerability leverages SQL errors to execute malicious scripts in the admin's browser.