CVE-2011-5313

Redaxscript 0.3.2 - SQL Injection via Password Reset Parameters

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2011-5313. PoCs published by High-Tech Bridge SA.

AI-analyzed exploit summary The document describes two vulnerabilities in Redaxscript 0.3.2: a path disclosure in '/templates/default/index.php' and an SQL injection in '/includes/password.php' via unsanitized 'id' and 'password' variables. It provides steps to exploit the SQLi but does not include executable code.

Description

Multiple SQL injection vulnerabilities in includes/password.php in Redaxscript 0.3.2 allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) password parameter to the password_reset program.

Exploits (1)

exploitdb WRITEUP VERIFIED
by High-Tech Bridge SA · textwebappsphp
https://www.exploit-db.com/exploits/16096

The document describes two vulnerabilities in Redaxscript 0.3.2: a path disclosure in '/templates/default/index.php' and an SQL injection in '/includes/password.php' via unsanitized 'id' and 'password' variables. It provides steps to exploit the SQLi but does not include executable code.

Classification
Writeup 100%
Attack Type
Sqli | Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Redaxscript 0.3.2
Auth required
Prerequisites: Registered user account · Access to password reset functionality
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

EPSS 0.0120
EPSS Percentile 64.2%

Details

CWE
CWE-89
Status published
Products (1)
redaxscript/redaxscript 0.3.2
Published Jan 01, 2015
Tracked Since Feb 18, 2026