The exploit demonstrates an SQL injection vulnerability in the XOOPS 'events' module by injecting a malicious SQL query via the 'id' parameter. The query extracts admin credentials from the 'xoops_users' table, confirming the vulnerability.
Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target:XOOPS events module
No auth needed
Prerequisites:Access to the vulnerable XOOPS events module endpoint