CVE-2014-5082
sphider < 1.3.6 - SQL Injection via site_id or url Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2014-5082. PoCs published by Mike Manzotti.
AI-analyzed exploit summary The exploit demonstrates SQL injection, PHP code injection (RCE), and XSS vulnerabilities in Sphider 1.3.6. It includes proof-of-concept payloads for each vulnerability type, with clear examples of malicious input and expected responses.
Description
Multiple SQL injection vulnerabilities in admin/admin.php in Sphider 1.3.6 and earlier, Sphider Pro, and Sphider-plus allow remote attackers to execute arbitrary SQL commands via the (1) site_id or (2) url parameter.
Exploits (2)
The exploit demonstrates SQL injection, PHP code injection (RCE), and XSS vulnerabilities in Sphider 1.3.6. It includes proof-of-concept payloads for each vulnerability type, with clear examples of malicious input and expected responses.
This is a detailed technical analysis of multiple vulnerabilities in Sphider Search Engine, including authentication bypass, SQL injection, and remote code execution. It provides proof-of-concept examples and explains the root causes, such as lack of input sanitization and insecure file writing practices.