CVE-2010-1706
2daybiz Auction Script - SQL Injection via Login Username Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2010-1706. PoCs published by Sid3^effects.
AI-analyzed exploit summary This writeup describes an authentication bypass vulnerability in 2daybiz Auction Script. The exploit involves using a SQL injection payload (' or 1=1 or ''=') in both the login and password fields to bypass authentication.
Description
Multiple SQL injection vulnerabilities in login.php in 2daybiz Auction Script allow remote attackers to execute arbitrary SQL commands via (1) the login field (aka the username parameter), and possibly (2) the password field, to index.php. NOTE: some of these details are obtained from third party information.
Exploits (1)
This writeup describes an authentication bypass vulnerability in 2daybiz Auction Script. The exploit involves using a SQL injection payload (' or 1=1 or ''=') in both the login and password fields to bypass authentication.