CVE-2008-2189

AnServ Auction XL - SQL Injection via viewfaqs.php cat Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-2189. PoCs published by K-159.

AI-analyzed exploit summary This exploit demonstrates a blind SQL injection vulnerability in Anserv Auction XL's viewfaqs.php via the 'cat' parameter. It allows remote attackers to extract admin credentials (username and MD5 password hash) when magic_quotes is disabled.

Description

SQL injection vulnerability in viewfaqs.php in AnServ Auction XL allows remote attackers to execute arbitrary SQL commands via the cat parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED
by K-159 · textwebappsphp
https://www.exploit-db.com/exploits/5543

This exploit demonstrates a blind SQL injection vulnerability in Anserv Auction XL's viewfaqs.php via the 'cat' parameter. It allows remote attackers to extract admin credentials (username and MD5 password hash) when magic_quotes is disabled.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: Anserv Auction XL (version unspecified)
No auth needed
Prerequisites: magic_quotes disabled in PHP configuration
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/42214
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/491608/100/0/threaded
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/30089
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/3874
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/29053
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/5543

Scores

EPSS 0.0133
EPSS Percentile 67.4%

Details

CWE
CWE-89
Status published
Products (1)
anserv/auction_xl
Published May 14, 2008
Tracked Since Feb 18, 2026