Exploitation Summary
EIP tracks 1 public exploit for CVE-2019-25431. PoCs published by cakes.
AI-analyzed exploit summary The exploit demonstrates SQL injection vulnerabilities in Blue-Smiley-Organizer 1.32 via the 'datetime' POST parameter, including boolean-based blind and time-based blind techniques. It also includes a payload to write a PHP command shell to a file.
Description
delpino73 Blue-Smiley-Organizer 1.32 contains an SQL injection vulnerability in the datetime parameter that allows unauthenticated attackers to manipulate database queries. Attackers can inject SQL code through POST requests to extract sensitive data using boolean-based blind and time-based blind techniques, or write files to the server using INTO OUTFILE statements.
Exploits (1)
The exploit demonstrates SQL injection vulnerabilities in Blue-Smiley-Organizer 1.32 via the 'datetime' POST parameter, including boolean-based blind and time-based blind techniques. It also includes a payload to write a PHP command shell to a file.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N