Exploitation Summary
EIP tracks 1 public exploit for CVE-2009-2326. PoCs published by eLwaux.
AI-analyzed exploit summary The exploit demonstrates multiple vulnerabilities in KerviNet, including blind SQL injection, SQL injection, XSS (stored and reflected), path disclosure, and unauthorized user deletion. It provides specific payloads and attack vectors for each vulnerability.
Description
Multiple SQL injection vulnerabilities in KerviNet Forum 1.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) an enter_parol cookie to index.php in an auto action or (2) the topic parameter to message.php. NOTE: vector 2 can be leveraged for a cross-site scripting (XSS) attack.
Exploits (1)
The exploit demonstrates multiple vulnerabilities in KerviNet, including blind SQL injection, SQL injection, XSS (stored and reflected), path disclosure, and unauthorized user deletion. It provides specific payloads and attack vectors for each vulnerability.