CVE-2008-6535

PayPal eStores - Unauthenticated Administrative Password Change via Direct Request

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-6535. PoCs published by G4N0K.

AI-analyzed exploit summary This exploit targets a vulnerability in PayPal eStore, allowing an attacker to change the admin password. The code is obfuscated using base64 and gzip encoding, which is decoded and executed at runtime.

Description

admin/settings.php in PayPal eStores allows remote attackers to bypass intended access restrictions and change the administrative password via a direct request with a modified NewAdmin parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED
by G4N0K · phpwebappsphp
https://www.exploit-db.com/exploits/7367

This exploit targets a vulnerability in PayPal eStore, allowing an attacker to change the admin password. The code is obfuscated using base64 and gzip encoding, which is decoded and executed at runtime.

Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: PayPal eStore (version not specified)
No auth needed
Prerequisites: Access to the PayPal eStore admin interface
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/33036
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/7367
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/47203
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/50682

Scores

EPSS 0.0633
EPSS Percentile 92.7%

Details

CWE
CWE-264
Status published
Products (1)
paypalestores/paypal_estores
Published Mar 26, 2009
Tracked Since Feb 18, 2026