PT-2009-5971 · Ebay · Ebay Clone

Mizoz · Published 2009-10-16 · Updated 2017-09-19 · CVE-2009-3712

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ebay Clone 2009

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the user id parameter to "feedback.php" and the item id parameter to "view full size.php", "classifide ad.php", and "crosspromoteitems.php".

Recommendations For Ebay Clone 2009, consider restricting access to the "feedback.php", "view full size.php", "classifide ad.php", and "crosspromoteitems.php" scripts until a fix is available. As a temporary workaround, avoid using the user id parameter in "feedback.php" and the item id parameter in the other affected scripts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-3712

Affected Products

Ebay Clone

References · 5

• 🔥 http://exploit-db.com/exploits/9125 · Exploit
• 🔥 https://exploit-db.com/exploits/9125 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3712 · Security Note
• http://secunia.com/advisories/35713 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51675 · Note