Description
SQL injection vulnerability in go.php in Scripts24 iPost 1.0.1 and iTGP 1.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter in a report action.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- Scripts24 iTGP 1.0.4 - 'id' SQL Injection EDB-6185 · webapps · Aug 1, 2008 · verified
- Scripts24 iPost 1.0.1 - 'id' SQL Injection EDB-6186 · webapps · Aug 1, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 47333 vdb-entry
- 6185 exploit
- 6186 exploit
- 31344 third-party-advisory
- 4117 third-party-advisory
- 30505 vdb-entry
- itgp-go-sql-injection(44175) vdb-entry
- ipost-go-sql-injection(44176) vdb-entry
- 31345 third-party-advisory
- 30504 vdb-entry