PT-2009-5643 · Php · Phpprobid

Noge · Published 2009-09-24 · Updated 2017-09-19 · CVE-2009-3336

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP Pro Bid (affected versions not specified)

Description The issue allows remote attackers to execute arbitrary SQL commands via the auction id parameter in the auction details.php file. This can lead to unauthorized access and manipulation of database content.

Recommendations For PHP Pro Bid, consider validating and sanitizing the auction id parameter to prevent SQL injection attacks. As a temporary workaround, restrict access to the auction details.php file until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-3336

Affected Products

Phpprobid

References · 5

• 🔥 http://exploit-db.com/exploits/9665 · Exploit
• 🔥 https://exploit-db.com/exploits/9665 · Exploit
• 🔥 http://securityfocus.com/bid/36389 · Exploit
• http://vupen.com/english/advisories/2009/2661 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3336 · Security Note