CVE-2008-0737
CandyPress 4.x and 3.x - SQL Injection via helpfield Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-0737. PoCs published by BugReport.IR.
AI-analyzed exploit summary The exploit demonstrates SQL injection, XSS, and path disclosure vulnerabilities in CandyPress eCommerce suite version 4.1.1.26. It includes functional PoC URLs to extract sensitive data such as admin credentials, payment details, and configuration settings.
Description
SQL injection vulnerability in admin/utilities_ConfigHelp.asp in CandyPress (CP) 4.1.1.26, and other 4.x and 3.x versions, allows remote attackers to execute arbitrary SQL commands via the helpfield parameter.
Exploits (1)
The exploit demonstrates SQL injection, XSS, and path disclosure vulnerabilities in CandyPress eCommerce suite version 4.1.1.26. It includes functional PoC URLs to extract sensitive data such as admin credentials, payment details, and configuration settings.