Exploitation Summary
EIP tracks 2 public exploits for CVE-2012-1029. PoCs published by Daniel Godoy.
AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in Tube Ace by injecting a script tag via the 'q' parameter in the search URL. The payload executes arbitrary JavaScript in the context of the affected site.
Description
SQL injection vulnerability in mobile/search/index.php in Tube Ace (Adult PHP Tube Script) 1.6 allows remote attackers to execute arbitrary SQL commands via the q parameter. NOTE: some of these details are obtained from third party information.
Exploits (2)
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Tube Ace by injecting a script tag via the 'q' parameter in the search URL. The payload executes arbitrary JavaScript in the context of the affected site.
This is a SQL injection proof-of-concept for Tube Ace (Adult PHP Tube Script), demonstrating a time-based blind SQLi via the 'q' parameter in the mobile search functionality. The exploit uses a crafted payload to trigger a conditional delay, confirming vulnerability.