CVE-2008-4458

E-Php B2B Trading Marketplace Script - SQL Injection via listings.php cid Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-4458. PoCs published by r45c4l.

AI-analyzed exploit summary This exploit demonstrates an SQL injection vulnerability in E-Php B2B Trading Marketplace Script by injecting a UNION-based query to extract database version, name, and user information. The attack leverages unsanitized input in the 'cid' parameter to execute arbitrary SQL commands.

Description

SQL injection vulnerability in listings.php in E-Php B2B Trading Marketplace Script allows remote attackers to execute arbitrary SQL commands via the cid parameter in a product action.

Exploits (1)

exploitdb WORKING POC VERIFIED

by r45c4l · textwebappsphp

https://www.exploit-db.com/exploits/32346

View Code ZIP pw:eip

This exploit demonstrates an SQL injection vulnerability in E-Php B2B Trading Marketplace Script by injecting a UNION-based query to extract database version, name, and user information. The attack leverages unsanitized input in the 'cid' parameter to execute arbitrary SQL commands.

Classification

Working Poc 90%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: E-Php B2B Trading Marketplace Script

No auth needed

Prerequisites: Access to the vulnerable 'listings.php' endpoint

MITRE ATT&CK