CVE-2009-3715
MCshoutbox 1.1 - SQL Injection via Username or Password Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2009-3715. PoCs published by SirGod.
AI-analyzed exploit summary The exploit demonstrates multiple vulnerabilities in MCshoutbox 1.1, including SQL injection for authentication bypass, XSS via the 'loginerror' parameter, and unrestricted file upload leading to remote shell execution. The PoC includes specific payloads and vulnerable code snippets.
Description
Multiple SQL injection vulnerabilities in scr_login.php in MCshoutbox 1.1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
Exploits (1)
The exploit demonstrates multiple vulnerabilities in MCshoutbox 1.1, including SQL injection for authentication bypass, XSS via the 'loginerror' parameter, and unrestricted file upload leading to remote shell execution. The PoC includes specific payloads and vulnerable code snippets.