Exploitation Summary
EIP tracks 1 public exploit for CVE-2018-25191. PoCs published by Ihsan Sencan.
AI-analyzed exploit summary This is a functional SQL injection exploit targeting the 'modid' parameter in Facturation System 1.0. The PoC demonstrates a time-based blind SQLi attack that extracts database information (user, database name, version) via a crafted HTTP POST request.
Description
Facturation System 1.0 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'mod_id' parameter. Attackers can send POST requests to the editar_producto.php endpoint with crafted SQL payloads in the mod_id parameter to extract sensitive database information including usernames, database names, and version details.
Exploits (1)
This is a functional SQL injection exploit targeting the 'modid' parameter in Facturation System 1.0. The PoC demonstrates a time-based blind SQLi attack that extracts database information (user, database name, version) via a crafted HTTP POST request.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N