Ebay · Ebay Clone · CVE-2009-3712
**Name of the Vulnerable Software and Affected Versions**
Ebay Clone 2009
**Description**
The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `user id` parameter to "feedback.php" and the `item id` parameter to "view full size.php", "classifide ad.php", and "crosspromoteitems.php".
**Recommendations**
For Ebay Clone 2009, consider restricting access to the "feedback.php", "view full size.php", "classifide ad.php", and "crosspromoteitems.php" scripts until a fix is available. As a temporary workaround, avoid using the `user id` parameter in "feedback.php" and the `item id` parameter in the other affected scripts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.