Exploitation Summary
EIP tracks 2 public exploits for CVE-2014-9173. PoCs published by Securely (Yoo Hee man), Kacper Szurek.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in Google Document Embedder 2.5.16, bypassing mysql_real_escape_string via a crafted UNION-based payload to leak user data from the wp_users table.
Description
SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote attackers to execute arbitrary SQL commands via the gpid parameter.
Exploits (2)
This exploit demonstrates a SQL injection vulnerability in Google Document Embedder 2.5.16, bypassing mysql_real_escape_string via a crafted UNION-based payload to leak user data from the wp_users table.
This exploit demonstrates a SQL injection vulnerability in Google Doc Embedder 2.5.14, where the `gpid` parameter is not properly escaped, allowing an attacker to extract sensitive data such as user passwords from the database.