4337Third-party advisory
http://securityreason.com/securityalert/4337 CVE-2008-4328
EasyRealtorPRO 2008 - 'site_search.php' Multiple SQL Injections
Record summary
CVE-2008-4328 has a selected CVSS score of 7.5; EIP currently links 1 catalogued exploit.
Description
SQL injection vulnerability in site_search.php in EasyRealtorPRO 2008 allows remote attackers to execute arbitrary SQL commands via the (1) item, (2) search_ordermethod, and (3) search_order parameters.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBEasyRealtorPRO 2008 - 'site_search.php' Multiple SQL InjectionsExploitDB exploitby David SopasNot analyzed1 file
References
6davidsopas.com
http://www.davidsopas.com/2008/09/sql-injection-in-easyrealtorpro 20080925 SQL Injection in EasyRealtorPRO 2008mailing list
http://www.securityfocus.com/archive/1/496744/100/0/threaded 31401vdb entry
http://www.securityfocus.com/bid/31401 easyrealtorpro-sitesearch-sql-injection(45418)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/45418 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2008-4328