CVE-2014-3119

HIGH

web2project < 3.1 - Authenticated SQL Injection via Search String or Update Key Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2014-3119. PoCs published by High-Tech Bridge SA.

AI-analyzed exploit summary The document describes SQL injection vulnerabilities in web2Project versions 3.1 and prior, specifically in the 'search_string' and 'updatekey' parameters. It includes exploitation examples for extracting MySQL version and writing arbitrary files, but does not contain executable exploit code.

Description

Multiple SQL injection vulnerabilities in web2Project 3.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search_string parameter in the contacts module to index.php or allow remote attackers to execute arbitrary SQL commands via the updatekey parameter to (2) do_updatecontact.php or (3) updatecontact.php.

Exploits (1)

exploitdb WRITEUP

by High-Tech Bridge SA · textwebappsphp

https://www.exploit-db.com/exploits/33818

View Code ZIP pw:eip

The document describes SQL injection vulnerabilities in web2Project versions 3.1 and prior, specifically in the 'search_string' and 'updatekey' parameters. It includes exploitation examples for extracting MySQL version and writing arbitrary files, but does not contain executable exploit code.

Classification

Writeup 100%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: web2Project 3.1 and prior

Auth required

Prerequisites: Access to vulnerable web2Project instance · Authentication for some vectors

MITRE ATT&CK