CVE-2009-1584
TemaTres 1.0.3 and 1.031 - SQL Injection via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2009-1584. PoCs published by YEnH4ckEr.
AI-analyzed exploit summary This exploit demonstrates multiple vulnerabilities in TemaTres V1.0.3, including SQL injection, authentication bypass, and cross-site scripting (XSS). It provides specific payloads and URLs to exploit these vulnerabilities, with clear examples for both authenticated and unauthenticated users.
Description
Multiple SQL injection vulnerabilities in TemaTres 1.0.3 and 1.031, when magic_quotes_gpc is disabled, allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the (1) mail, (2) password, and (3) letra parameters to index.php; (4) y and (5) m parameters to sobre.php; and the (6) dcTema, (7) madsTema, (8) zthesTema, (9) skosTema, and (10) xtmTema parameters to xml.php.
Exploits (2)
This exploit demonstrates multiple vulnerabilities in TemaTres V1.0.3, including SQL injection, authentication bypass, and cross-site scripting (XSS). It provides specific payloads and URLs to exploit these vulnerabilities, with clear examples for both authenticated and unauthenticated users.
This Perl script exploits a blind SQL injection vulnerability in TemaTres CMS v1.0.3 via the 'dcTema', 'madsTema', 'zthesTema', 'skosTema', and 'xtmTema' parameters. It automates the extraction of user data by brute-forcing character values based on ASCII responses.