Exploitation Summary
EIP tracks 1 public exploit for CVE-2018-25364. PoCs published by L0RD.
AI-analyzed exploit summary The exploit demonstrates SQL injection vulnerabilities in Twitter-Clone 1 via three endpoints (search.php, mailactivation.php, stalkers.php) with specific payloads for error-based and union-based SQLi. The vulnerable code snippets show direct interpolation of user input into SQL queries without sanitization.
Description
Twitter-Clone 1 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the name parameter. Attackers can submit crafted payloads to the search.php endpoint to extract database information including usernames, credentials, and system data using error-based and union-based SQL injection techniques.
Exploits (1)
The exploit demonstrates SQL injection vulnerabilities in Twitter-Clone 1 via three endpoints (search.php, mailactivation.php, stalkers.php) with specific payloads for error-based and union-based SQLi. The vulnerable code snippets show direct interpolation of user input into SQL queries without sanitization.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N