Exploitation Summary
EIP tracks 1 public exploit for CVE-2018-25300. PoCs published by MgThuraMoeMyint.
AI-analyzed exploit summary This exploit demonstrates a Union-Based SQL Injection vulnerability in XATABoost CMS 1.0.0. The injection point is in the 'id' parameter of 'news.php', allowing attackers to extract sensitive data from the database.
Description
XATABoost CMS 1.0.0 contains a union-based SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the id parameter. Attackers can send GET requests to news.php with malicious id values to extract sensitive database information.
Exploits (1)
This exploit demonstrates a Union-Based SQL Injection vulnerability in XATABoost CMS 1.0.0. The injection point is in the 'id' parameter of 'news.php', allowing attackers to extract sensitive data from the database.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N