Exploitation Summary
EIP tracks 3 public exploits for CVE-2014-9173. PoCs published by Securely (Yoo Hee man), Kacper Szurek, ratiros01.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in Google Document Embedder 2.5.16, bypassing mysql_real_escape_string via a crafted UNION-based payload to leak user data from the wp_users table.
Description
SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote attackers to execute arbitrary SQL commands via the gpid parameter.
Exploits (3)
This exploit demonstrates a SQL injection vulnerability in Google Document Embedder 2.5.16, bypassing mysql_real_escape_string via a crafted UNION-based payload to leak user data from the wp_users table.
This exploit demonstrates a SQL injection vulnerability in Google Doc Embedder 2.5.14, where the `gpid` parameter is not properly escaped, allowing an attacker to extract sensitive data such as user passwords from the database.
Technical writeup detailing time-based blind SQL injection (SQLi) exploitation for CVE-2014-9173 in the WordPress Google Document Embedder plugin. Includes manual exploitation steps, payload construction, and SQLMap automation guidance for extracting database contents via timing delays.