Exploitation Summary
EIP tracks 2 public exploits for CVE-2012-1665. PoCs published by High-Tech Bridge SA.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in osCMax 2.5.0, allowing an attacker to write arbitrary PHP code to a file via the 'INTO OUTFILE' clause. The PoC shows how an attacker could achieve remote code execution by injecting malicious PHP code into a file on the server.
Description
Multiple SQL injection vulnerabilities in the admin panel in osCMax before 2.5.1 allow (1) remote attackers to execute arbitrary SQL commands via the username parameter in a process action to admin/login.php or (2) remote administrators to execute arbitrary SQL commands via the status parameter to admin/stats_monthly_sales.php or (3) country parameter in a process action to admin/create_account_process.php.
Exploits (2)
This exploit demonstrates a SQL injection vulnerability in osCMax 2.5.0, allowing an attacker to write arbitrary PHP code to a file via the 'INTO OUTFILE' clause. The PoC shows how an attacker could achieve remote code execution by injecting malicious PHP code into a file on the server.
This exploit demonstrates a SQL injection vulnerability in osCMax 2.5.0 by injecting a malicious payload into the username field of the login form. The payload attempts to extract the database version via a time-based blind SQL injection technique.