This exploit demonstrates a blind SQL injection vulnerability in Tiny Tiny RSS, where the `item_id` parameter in `process_category_order()` is not properly escaped. The PoC uses a crafted payload to extract the first character of the admin's password hash via time-based SQL injection.
Classification
Working Poc 95%
Target:
Tiny Tiny RSS (versions before commit a5556c2471973e292dce615fe0c77fdbbc54405b)
Auth required
Prerequisites:
Valid user credentials · Access to the backend.php endpoint