Exploitation Summary
EIP tracks 1 public exploit for CVE-2010-4151. PoCs published by girex.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in DeluxeBB 1.3 and prior, allowing an attacker to retrieve all usernames and password hashes from the database without authentication. The vulnerability arises from improper handling of the 'order' parameter in misc.php, enabling arbitrary SQL queries.
Description
SQL injection vulnerability in misc.php in DeluxeBB 1.3, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the xthedateformat parameter in a register action, a different vector than CVE-2005-2989, CVE-2006-2503, and CVE-2009-1033.
Exploits (1)
This exploit demonstrates a SQL injection vulnerability in DeluxeBB 1.3 and prior, allowing an attacker to retrieve all usernames and password hashes from the database without authentication. The vulnerability arises from improper handling of the 'order' parameter in misc.php, enabling arbitrary SQL queries.