CVE-2008-0738
CandyPress Store < 4.1 - SQL Injection via idcust or tableName Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-0738.
AI-analyzed exploit summary The exploit demonstrates SQL injection and XSS vulnerabilities in CandyPress eCommerce suite version 4.1.1.26. It includes multiple proof-of-concept URLs that extract sensitive data from the database, such as admin credentials, payment details, and configuration settings.
Description
Multiple SQL injection vulnerabilities in CandyPress (CP) 4.1.1.26, and earlier 4.1.x versions, allow remote attackers to execute arbitrary SQL commands via the (1) idcust parameter to (a) ajax_getTiers.asp and (b) ajax_getCust.asp in ajax/, and the (2) tableName parameter to (c) ajax/ajax_tableFields.asp. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Exploits (1)
The exploit demonstrates SQL injection and XSS vulnerabilities in CandyPress eCommerce suite version 4.1.1.26. It includes multiple proof-of-concept URLs that extract sensitive data from the database, such as admin credentials, payment details, and configuration settings.