Exploitation Summary
EIP tracks 1 public exploit for CVE-2018-25167. PoCs published by Ihsan Sencan.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in Net-Billetterie 2.9's login.inc.php. The payload bypasses authentication by injecting a crafted SQL query via the 'login' parameter, leveraging the lack of input sanitization.
Description
Net-Billetterie 2.9 contains an SQL injection vulnerability in the login parameter of login.inc.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can submit malicious SQL code through the login POST parameter to extract database information including usernames, passwords, and system credentials.
Exploits (1)
This exploit demonstrates a SQL injection vulnerability in Net-Billetterie 2.9's login.inc.php. The payload bypasses authentication by injecting a crafted SQL query via the 'login' parameter, leveraging the lack of input sanitization.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N