Description
SQL injection vulnerability in includes/nsbypass.php in NukeSentinel 2.5.05, 2.5.11, and other versions before 2.5.12 allows remote attackers to execute arbitrary SQL commands via an admin cookie.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- NukeSentinel 2.5.05 - 'nsbypass.php' Blind SQL Injection EDB-3337 · webapps · Feb 20, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://www.waraxe.us/advisory-53.html
- nukesentinel-nsbypass-sql-injection(32582) vdb-entry
- 22629 vdb-entry
- http://www.nukescripts.net/index.php?op=NEArticle&sid=4076
- 20070928 CVE-2007-5125 - dupe mailing-list
- 3337 exploit
- 2344 third-party-advisory
- 20070928 Re: [waraxe-2007-SA#053] - Critical Sql Injection in NukeSentinel 2.5.11 mailing-list
- 20070220 NukeSentinel 2.5.05 (nsbypass.php) Blind SQL Injection Exploit mailing-list
- 20070925 [waraxe-2007-SA#053] - Critical Sql Injection in NukeSentinel 2.5.11 mailing-list
- 25805 vdb-entry
- 26954 third-party-advisory