CVE-2011-1047
VastHTML Forum Server 1.6.1 and 1.6.5 - SQL Injection via Search Max Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2011-1047. PoCs published by High-Tech Bridge SA.
AI-analyzed exploit summary The exploit demonstrates SQL injection vulnerabilities in the WP Forum Server WordPress plugin (version 1.6.5) via the 'search_max' and 'topic' parameters. The PoC includes crafted HTTP requests to inject malicious SQL queries, potentially allowing database manipulation or information disclosure.
Description
Multiple SQL injection vulnerabilities in VastHTML Forum Server (aka ForumPress) plugin 1.6.1 and 1.6.5 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) search_max parameter in a search action to index.php, which is not properly handled by wpf.class.php, (2) id parameter in an editpost action to index.php, which is not properly handled by wpf-post.php, or (3) topic parameter to feed.php.
Exploits (1)
The exploit demonstrates SQL injection vulnerabilities in the WP Forum Server WordPress plugin (version 1.6.5) via the 'search_max' and 'topic' parameters. The PoC includes crafted HTTP requests to inject malicious SQL queries, potentially allowing database manipulation or information disclosure.