PT-2008-5976 · Oscommerce · Oscommerce Poll Booth Add-On

S@Bun · Published 2008-10-28 · Updated 2017-09-29 · CVE-2008-4765

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions osCommerce Poll Booth Add-On version 2.0

Description The issue concerns a SQL injection vulnerability. It allows remote attackers to execute arbitrary SQL commands via the pollID parameter in a results operation.

Recommendations For osCommerce Poll Booth Add-On version 2.0, consider restricting access to the pollID parameter in the results operation to minimize the risk of exploitation. Avoid using the pollID parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-4765

Affected Products

Oscommerce Poll Booth Add-On

References · 6

• 🔥 http://packetstormsecurity.org/0804-exploits/pollbooth20-sql.txt · Exploit
• 🔥 https://exploit-db.com/exploits/5436 · Exploit
• 🔥 http://securityfocus.com/bid/28752 · Exploit
• 🔥 https://exploit-db.com/exploits/31640 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4765 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41796 · Note