CVE-2008-3604

CRITICAL

ZeeBuddy 2.1 - SQL Injection via bannerclick.php adid Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-3604. PoCs published by Hussin X.

AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in ZeeBuddy v2.1 via the 'adid' parameter in bannerclick.php. The PoC uses a UNION-based SQLi to extract admin credentials (name and password) from the database.

Description

SQL injection vulnerability in bannerclick.php in ZeeBuddy 2.1 allows remote attackers to execute arbitrary SQL commands via the adid parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Hussin X · textwebappsphp
https://www.exploit-db.com/exploits/6230

This exploit demonstrates a SQL injection vulnerability in ZeeBuddy v2.1 via the 'adid' parameter in bannerclick.php. The PoC uses a UNION-based SQLi to extract admin credentials (name and password) from the database.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: ZeeBuddy v2.1
No auth needed
Prerequisites: Access to the vulnerable bannerclick.php endpoint
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (5)

Core 5
Core References
Exploit, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/30628
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/6230
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/31413
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/4145

Scores

CVSS v3 9.8
EPSS 0.0255
EPSS Percentile 85.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
zeescripts/zeebuddy 2.1
Published Aug 12, 2008
Tracked Since Feb 18, 2026