CVE-2014-8682
NUCLEIGogs 0.3.1-0.5.x - SQL Injection via Search API q Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2014-8682. PoCs published by Timo Schmid, nihal1306. A Nuclei detection template is also available.
AI-analyzed exploit summary This is a detailed technical writeup describing an unauthenticated SQL injection vulnerability in Gogs (CVE-2014-8682). It includes vulnerable code sections, proof-of-concept payloads, and a patch analysis.
Description
Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly handled in models/user.go.
Exploits (2)
This is a detailed technical writeup describing an unauthenticated SQL injection vulnerability in Gogs (CVE-2014-8682). It includes vulnerable code sections, proof-of-concept payloads, and a patch analysis.
This repository contains a detailed setup guide for Gogs (Go Git Service) and does not include any exploit code or proof-of-concept for CVE-2024-8682. It provides instructions for installing and configuring Gogs, MySQL, Go, and Nginx.
Nuclei Templates (1)
title:"Sign In - Gogs" || http.title:"sign in - gogs" || cpe:"cpe:2.3:a:gogs:gogs"
title="sign in - gogs"