Exploitation Summary
EIP tracks 1 public exploit for CVE-2018-25192. PoCs published by Ihsan Sencan.
AI-analyzed exploit summary This is a functional SQL injection exploit for GPS Tracking System 2.12, demonstrating an authentication bypass via a crafted 'username' parameter in the login form. The PoC includes a raw HTTP request with a classic SQLi payload ('or 1=1) that bypasses authentication and redirects to the admin panel.
Description
GPS Tracking System 2.12 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through the username parameter. Attackers can submit crafted POST requests to the login.php endpoint with SQL injection payloads in the username field to gain unauthorized access without valid credentials.
Exploits (1)
This is a functional SQL injection exploit for GPS Tracking System 2.12, demonstrating an authentication bypass via a crafted 'username' parameter in the login form. The PoC includes a raw HTTP request with a classic SQLi payload ('or 1=1) that bypasses authentication and redirects to the admin panel.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N