Exploitation Summary
EIP tracks 1 public exploit for CVE-2009-3514. PoCs published by SirGod.
AI-analyzed exploit summary This exploit demonstrates SQL injection and local file inclusion vulnerabilities in d.net CMS. The SQLi allows unauthorized retrieval of admin credentials, while the LFI enables reading arbitrary files with admin access.
Description
Multiple SQL injection vulnerabilities in d.net CMS allow remote attackers to execute arbitrary SQL commands via (1) the page parameter to index.php; and allow remote authenticated administrators to execute arbitrary SQL commands via the (2) edit_id and (3) _p parameter in a news action to dnet_admin/index.php.
Exploits (1)
This exploit demonstrates SQL injection and local file inclusion vulnerabilities in d.net CMS. The SQLi allows unauthorized retrieval of admin credentials, while the LFI enables reading arbitrary files with admin access.