CVE-2015-1428
Sefrengo < 1.6.1 - SQL Injection via sefrengo Cookie or value_id Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2015-1428. PoCs published by ITAS Team.
AI-analyzed exploit summary This exploit demonstrates SQL injection vulnerabilities in Sefrengo CMS v1.6.1, specifically targeting the `id` parameter in the `ac_get_value` function and the `value_id` parameter in the `set_value` function. The PoC includes HTTP requests with injection points marked.
Description
Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow (1) remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or (2) remote authenticated users to execute arbitrary SQL commands via the value_id parameter in a save_value action to backend/main.php.
Exploits (1)
This exploit demonstrates SQL injection vulnerabilities in Sefrengo CMS v1.6.1, specifically targeting the `id` parameter in the `ac_get_value` function and the `value_id` parameter in the `set_value` function. The PoC includes HTTP requests with injection points marked.