Exploitation Summary
EIP tracks 1 public exploit for CVE-2014-9528. PoCs published by Jos Wetzels_ Emiel Florijn.
AI-analyzed exploit summary The exploit describes an SQL injection vulnerability in Humhub <= 0.10.0-rc.1 due to unsanitized input in the 'from' GET parameter, allowing database access and reflected XSS. Proof-of-concept examples are provided for SQLi and CSRF attacks.
Description
SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListController.php in HumHub 0.10.0-rc.1 and earlier allows remote authenticated users to execute arbitrary SQL commands via the from parameter to index.php. NOTE: this can be leveraged for cross-site scripting (XSS) attacks via a request that causes an error.
Exploits (1)
The exploit describes an SQL injection vulnerability in Humhub <= 0.10.0-rc.1 due to unsanitized input in the 'from' GET parameter, allowing database access and reflected XSS. Proof-of-concept examples are provided for SQLi and CSRF attacks.