CVE-2012-1603
NextBBS 0.6 - SQL Injection via curstr id or username Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2012-1603. PoCs published by waraxe.
AI-analyzed exploit summary The provided text describes multiple vulnerabilities in NextBBS 0.6.0, including SQL injection, XSS, and authentication bypass, with example URLs demonstrating SQL injection via the 'curstr', 'id', and 'username' parameters.
Description
Multiple SQL injection vulnerabilities in ajaxserver.php in NextBBS 0.6 allow remote attackers to execute arbitrary SQL commands via the (1) curstr parameter in the findUsers function, (2) id parameter in the isIdAvailable function, or (3) username parameter in the getGreetings function.
Exploits (1)
The provided text describes multiple vulnerabilities in NextBBS 0.6.0, including SQL injection, XSS, and authentication bypass, with example URLs demonstrating SQL injection via the 'curstr', 'id', and 'username' parameters.