Exploitation Summary
EIP tracks 4 public exploits for CVE-2014-5104. PoCs published by AtT4CKxT3rR0r1ST.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in ol-commerce 2.1.1 via the 'country' parameter in the account creation process. The payload extracts database and version information using a time-based blind SQLi technique.
Description
Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) a_country parameter in a process action to affiliate_signup.php, (2) affiliate_banner_id parameter to affiliate_show_banner.php, (3) country parameter in a process action to create_account.php, or (4) entry_country_id parameter in an edit action to admin/create_account.php.
Exploits (4)
This exploit demonstrates a SQL injection vulnerability in ol-commerce 2.1.1 via the 'country' parameter in the account creation process. The payload extracts database and version information using a time-based blind SQLi technique.
This exploit demonstrates a SQL injection vulnerability in ol-commerce 2.1.1 via the 'a_country' parameter in the affiliate signup process. The PoC includes a crafted HTTP POST request with a malicious payload to extract sensitive data from the 'customers' table.
The provided text describes SQL injection and XSS vulnerabilities in ol-commerce 2.1.1, with an example URL demonstrating the SQL injection point. No actual exploit code is included.
This exploit demonstrates a SQL injection vulnerability in ol-commerce 2.1.1 via the `entry_country_id` parameter in the admin create_account.php endpoint. The PoC includes a crafted payload to extract database information and version details.