Exploitation Summary
EIP tracks 1 public exploit for CVE-2014-8995. PoCs published by ZoRLu Bugrahan.
AI-analyzed exploit summary This exploit demonstrates an insecure cookie handling vulnerability in Maarch LetterBox 2.8, allowing an attacker to bypass authentication by manipulating the 'UserId' cookie with a SQL injection payload.
Description
SQL injection vulnerability in Maarch LetterBox 2.8 allows remote attackers to execute arbitrary SQL commands via the UserId cookie.
Exploits (1)
exploitdb
WORKING POC
by ZoRLu Bugrahan · textwebappsphp
https://www.exploit-db.com/exploits/35271
This exploit demonstrates an insecure cookie handling vulnerability in Maarch LetterBox 2.8, allowing an attacker to bypass authentication by manipulating the 'UserId' cookie with a SQL injection payload.
Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target:
Maarch LetterBox 2.8
No auth needed
Prerequisites:
Access to the target application's login page · Ability to modify browser cookies
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026
Full analysis →
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/98775
Exploit x_refsource_misc
http://packetstormsecurity.com/files/129135/Maarch-LetterBox-2.8-Insecure-Cookie-Handling.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://www.osvdb.org/114772
Scores
EPSS
0.0222
EPSS Percentile
80.3%
Details
CWE
CWE-89
Status
published
Products (1)
maarch/letterbox
2.8
Published
Nov 20, 2014
Tracked Since
Feb 18, 2026