CVE-2013-3727
Kasseler CMS < 2 - Authenticated SQL Injection via groups[] Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2013-3727.
AI-analyzed exploit summary The exploit demonstrates SQL injection (CVE-2013-3727), stored XSS (CVE-2013-3728), and CSRF (CVE-2013-3729) in Kasseler CMS. It includes functional PoC code for each vulnerability, including a CSRF-based SQLi exploit using DNS exfiltration.
Description
SQL injection vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users to execute arbitrary SQL commands via the groups[] parameter to admin.php. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
Exploits (1)
The exploit demonstrates SQL injection (CVE-2013-3727), stored XSS (CVE-2013-3728), and CSRF (CVE-2013-3729) in Kasseler CMS. It includes functional PoC code for each vulnerability, including a CSRF-based SQLi exploit using DNS exfiltration.