CVE-2011-0443

tinybb 1.2 - SQL Injection via id Parameter in Profile Action

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2011-0443. PoCs published by Aodrulez.

AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in TinyBB 1.2 by manipulating the 'id' parameter in the profile page URL. The provided payload bypasses authentication and extracts data from the database.

Description

SQL injection vulnerability in inc/tinybb-settings.php in tinyBB 1.2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a profile action to index.php. NOTE: some of these details are obtained from third party information.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Aodrulez · textwebappsphp

https://www.exploit-db.com/exploits/15961

View Code ZIP pw:eip

This exploit demonstrates a SQL injection vulnerability in TinyBB 1.2 by manipulating the 'id' parameter in the profile page URL. The provided payload bypasses authentication and extracts data from the database.

Classification

Working Poc 90%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: TinyBB 1.2

No auth needed

Prerequisites: Access to the vulnerable TinyBB 1.2 web application

MITRE ATT&CK