high7.5Public exploit code
CVE-2009-2439
Multiple SQL injection vulnerabilities in Web Development House Alibaba Clone allow remote attackers to execute arbitrary SQL commands via the (1) IndustryID p…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Alibaba-clone CMS - SQL Injection / Blind SQL Injection2009-07-20 · webapps · php · Verified
- cms (id) 5.0 - SQL Injection2010-04-22 · webapps · php
Impact
Multiple SQL injection vulnerabilities in Web Development House Alibaba Clone allow remote attackers to execute arbitrary SQL commands via the (1) IndustryID parameter to category.php and the (2) SellerID parameter to supplier/view_contact_details.php. NOTE: this is a product that was developed by a third party; it is not associated with alibaba.com or the Alibaba Group.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Web Development House | Alibaba Clone | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.org/0907-exploits/alibabaclone-sql.txt
- http://secunia.com/advisories/35741
- http://www.vupen.com/english/advisories/2009/1838
- http://packetstormsecurity.org/0907-exploits/alibabaclone-sql.txt
- http://secunia.com/advisories/35741
- http://www.vupen.com/english/advisories/2009/1838