CVE-2018-25209
HIGHOpenBiz Cubi Lite 3.0.8 SQL Injection via username Parameter
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2018-25209. PoCs published by AkkuS.
AI-analyzed exploit summary This exploit demonstrates a time-based blind SQL injection vulnerability in OpenBiz Cubi Lite 3.0.8 via the 'username' parameter in a multipart form submission. The payload uses a SLEEP function to confirm the vulnerability.
Description
OpenBiz Cubi Lite 3.0.8 contains a SQL injection vulnerability in the login form that allows unauthenticated attackers to manipulate database queries through the username parameter. Attackers can submit POST requests to /bin/controller.php with malicious SQL code in the username field to extract sensitive database information or bypass authentication.
Exploits (1)
This exploit demonstrates a time-based blind SQL injection vulnerability in OpenBiz Cubi Lite 3.0.8 via the 'username' parameter in a multipart form submission. The payload uses a SLEEP function to confirm the vulnerability.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N