Exploitation Summary
EIP tracks 2 public exploits for CVE-2009-2439. PoCs published by 599eme Man, spykit.
AI-analyzed exploit summary This exploit demonstrates SQL injection and blind SQL injection vulnerabilities in Alibaba-clone CMS. It provides proof-of-concept URLs to extract database information such as version, user, and database name.
Description
Multiple SQL injection vulnerabilities in Web Development House Alibaba Clone allow remote attackers to execute arbitrary SQL commands via the (1) IndustryID parameter to category.php and the (2) SellerID parameter to supplier/view_contact_details.php. NOTE: this is a product that was developed by a third party; it is not associated with alibaba.com or the Alibaba Group.
Exploits (2)
This exploit demonstrates SQL injection and blind SQL injection vulnerabilities in Alibaba-clone CMS. It provides proof-of-concept URLs to extract database information such as version, user, and database name.
This exploit demonstrates a SQL injection vulnerability in CmS version 5.0, specifically targeting the 'IndustryID' parameter in the 'category.php' file. The PoC uses a UNION-based SQL injection to extract sensitive information such as admin credentials and email details.