Exploitation Summary
EIP tracks 1 public exploit for CVE-2020-18662. PoCs published by CodeSecLab.
AI-analyzed exploit summary This exploit demonstrates SQL injection in Gnuboard5 5.3.2.8 via the `table_prefix` parameter in the installation script. It includes two PoC examples: one using a time-based payload (`sleep(5)`) and another with a boolean-based payload (`OR 1=1--`).
Description
SQL Injection vulnerability in gnuboard5 <=v5.3.2.8 via the table_prefix parameter in install_db.php.
Exploits (1)
exploitdb
WORKING POC
by CodeSecLab · textwebappsphp
https://www.exploit-db.com/exploits/52167
This exploit demonstrates SQL injection in Gnuboard5 5.3.2.8 via the `table_prefix` parameter in the installation script. It includes two PoC examples: one using a time-based payload (`sleep(5)`) and another with a boolean-based payload (`OR 1=1--`).
Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target:
Gnuboard5 5.3.2.8
No auth needed
Prerequisites:
Access to the installation endpoint (`/install/install_db.php`)
devstral-2 · analyzed Feb 16, 2026
Full analysis →
References (3)
Core 3
Core References
Exploit, Technical Description x_refsource_misc
https://github.com/gnuboard/gnuboard5/issues/43
Third Party Advisory x_refsource_misc
https://www.seebug.org/vuldb/ssvid-97927
Third Party Advisory x_refsource_misc
https://github.com/LoRexxar/CVE_Request/tree/master/gnuboard5%20mul%20vuls%20before%20v5.3.2.8#sql-injection-in-install_dbphp
Scores
CVSS v3
9.8
EPSS
0.0039
EPSS Percentile
60.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-89
Status
published
Products (1)
sir/gnuboard
< 5.3.2.8
Published
Jun 24, 2021
Tracked Since
Feb 18, 2026