Exploitation Summary
EIP tracks 2 public exploits for CVE-2010-4782. PoCs published by underground-stockholm.com, ajann.
AI-analyzed exploit summary This exploit demonstrates SQL injection vulnerabilities in Ananda Real Estate 3.4 via the 'list.asp' page. Multiple parameters (city, state, country, minprice, maxprice, bed, bath) are vulnerable to SQLi using a simple union-based injection technique.
Description
Multiple SQL injection vulnerabilities in list.asp in Softwebs Nepal (aka Ananda Raj Pandey) Ananda Real Estate 3.4 allow remote attackers to execute arbitrary SQL commands via the (1) city, (2) state, (3) country, (4) minprice, (5) maxprice, (6) bed, and (7) bath parameters, different vectors than CVE-2006-6807.
Exploits (2)
This exploit demonstrates SQL injection vulnerabilities in Ananda Real Estate 3.4 via the 'list.asp' page. Multiple parameters (city, state, country, minprice, maxprice, bed, bath) are vulnerable to SQLi using a simple union-based injection technique.
This exploit demonstrates a SQL injection vulnerability in Ananda Real Estate <= 3.4 via the 'agent' parameter in list.asp. The provided URL-encoded payload extracts username and password from the 'user' table.