Eshopbuilde CMS - SQL Injection

ExploitDBExploitDB exploitScannerEDB-10253

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a text writeup that lists multiple SQL injection entry points in Eshopbuilde CMS. It provides example URLs with test payloads (e.g., '@@version', 'JyI%3D', '%00') that are designed to detect or validate the presence of SQL injection vulnerabilities by observing application responses, not to extract data or gain access. No exploit code is present.

Backdoor review

No backdoor observed in reviewed code

The supplied text is a plain-text vulnerability disclosure describing SQL injection vectors in Eshopbuilde CMS. It contains no executable code, no instructions for the reader to run anything, and no concealed or deceptive payload. The content is limited to parameter names, example URLs, and remediation advice.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesEnglish
Target softwareEshopbuilde CMS
Attack typesSQL Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains only example URLs with test payloads (e.g., '@@version', 'JyI%3D', '%00') that are typical of vulnerability detection/validation, not exploitation. It lacks any code to extract data, establish a shell, or perform post-exploitation actions. The content is a writeup describing injection points, but the provided payloads function as a scanner to confirm SQL injection.

exploits/asp/webapps/10253.txt:26-28exploits/asp/webapps/10253.txt:24-68

Requirements

  • Target running Eshopbuilde CMS with accessible vulnerable ASP scriptsexploits/asp/webapps/10253.txt:24-28

Observed behavior

  • Provides example HTTP requests with SQL injection test strings in parameters like sitebid to detect vulnerabilityexploits/asp/webapps/10253.txt:26-28
  • Lists multiple vulnerable scripts and parameters without providing data extraction or command execution logicexploits/asp/webapps/10253.txt:24-68
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Disclosure
SQL injection in Eshopbuilde CMSThe file documents multiple SQL injection points across several ASP scripts, consistent with the associated CVE-2009-4155.exploits/asp/webapps/10253.txt:3exploits/asp/webapps/10253.txt:24-68
Review boundaries

What the analysis did not establish

  • Only the single text file from ExploitDB is analyzed; no external tools, libraries, or referenced resources are expanded.
  • The artifact does not include any executable code or scripts; classification is based solely on the provided text content.
  • Only the single text file (10253.txt) was reviewed; no external resources, tools, or referenced URLs were fetched or analyzed.
  • The review does not assess the correctness or completeness of the vulnerability disclosure.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1