CVE-2013-2945

b2evolution < 4.1.7 - Authenticated SQL Injection via show_statuses[] Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2013-2945. PoCs published by High-Tech Bridge SA.

AI-analyzed exploit summary The advisory describes a SQL injection vulnerability in b2evolution (CVE-2013-2945) affecting versions 4.1.6 and prior. The vulnerability allows an authenticated administrator to execute arbitrary SQL commands via the 'show_statuses' parameter in '/blogs/admin.php'.

Description

SQL injection vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote authenticated administrators to execute arbitrary SQL commands via the show_statuses[] parameter. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.

Exploits (1)

exploitdb WRITEUP VERIFIED

by High-Tech Bridge SA · textwebappsphp

https://www.exploit-db.com/exploits/25298

View Code ZIP pw:eip

The advisory describes a SQL injection vulnerability in b2evolution (CVE-2013-2945) affecting versions 4.1.6 and prior. The vulnerability allows an authenticated administrator to execute arbitrary SQL commands via the 'show_statuses' parameter in '/blogs/admin.php'.

Classification

Writeup 100%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: b2evolution 4.1.6 and prior

Auth required

Prerequisites: Authenticated administrator access · Database write permissions

MITRE ATT&CK