CVE-2014-9235
Zoph < 0.9.1 - Authenticated SQL Injection via _action or location_id Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2014-9235.
AI-analyzed exploit summary The exploit demonstrates SQL injection and XSS vulnerabilities in Zoph <= 0.9.1 via crafted HTTP GET requests targeting specific parameters in group.php, photos.php, user.php, and edit_photos.php. The PoC includes clear examples of malicious input for both attack types.
Description
Multiple SQL injection vulnerabilities in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) _action parameter to group.php or (2) user.php or the (3) location_id parameter to photos.php in php/.
Exploits (1)
The exploit demonstrates SQL injection and XSS vulnerabilities in Zoph <= 0.9.1 via crafted HTTP GET requests targeting specific parameters in group.php, photos.php, user.php, and edit_photos.php. The PoC includes clear examples of malicious input for both attack types.