CVE-2014-9096
Pligg CMS < 2.0.1 - SQL Injection via Recover.php ID or N Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2014-9096. PoCs published by BlackHawk.
AI-analyzed exploit summary This exploit targets Pligg CMS <= 2.0.1, leveraging SQL injection in the password recovery functionality to escalate privileges, extract database credentials, and achieve remote code execution via a Weevely shell. The attack chain involves manipulating the 'recover.php' endpoint and abusing admin panel features to write arbitrary files.
Description
Multiple SQL injection vulnerabilities in recover.php in Pligg CMS 2.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) n parameter.
Exploits (1)
This exploit targets Pligg CMS <= 2.0.1, leveraging SQL injection in the password recovery functionality to escalate privileges, extract database credentials, and achieve remote code execution via a Weevely shell. The attack chain involves manipulating the 'recover.php' endpoint and abusing admin panel features to write arbitrary files.