Exploitation Summary
EIP tracks 2 public exploits for CVE-2009-1362. PoCs published by Valentin, tmh.
AI-analyzed exploit summary This writeup describes an indirect SQL injection and XSS vulnerability in chCounter 3.1.1, where an attacker manipulates page titles or user agents to inject malicious SQL or XSS payloads, which execute when an admin views visitor details in the backend.
Description
SQL injection vulnerability in administration/index.php in chCounter 3.1.3 allows remote attackers to execute arbitrary SQL commands via the login_name parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Exploits (2)
This writeup describes an indirect SQL injection and XSS vulnerability in chCounter 3.1.1, where an attacker manipulates page titles or user agents to inject malicious SQL or XSS payloads, which execute when an admin views visitor details in the backend.
This exploit describes an authentication bypass vulnerability in chCounter 3.1.3, where using ' or = as the username and password allows unauthorized access. The exploit requires magic quotes to be disabled on the target system.