Exploitation Summary
EIP tracks 1 public exploit for CVE-2015-2237. PoCs published by ZeQ3uL.
AI-analyzed exploit summary This exploit demonstrates an authentication bypass via SQL injection in the login function and a secondary SQL injection in the `showprofile.php` endpoint. It bypasses authentication by injecting a tautology into the username parameter and then extracts database information (user and database name) via a UNION-based SQL injection.
Description
Multiple SQL injection vulnerabilities in Betster (aka PHP Betoffice) 1.0.4 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) showprofile.php or (2) categoryedit.php or (3) username parameter in a login to index.php.
Exploits (1)
This exploit demonstrates an authentication bypass via SQL injection in the login function and a secondary SQL injection in the `showprofile.php` endpoint. It bypasses authentication by injecting a tautology into the username parameter and then extracts database information (user and database name) via a UNION-based SQL injection.