CVE-2009-3510

linkspheric 0.74 Beta 6 - SQL Injection via listID Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-3510. PoCs published by NoGe.

AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in linkSpheric 0.74 Beta 6 via the 'listID' parameter in viewListing.php. The PoC includes URLs that extract user credentials using a UNION-based SQLi attack.

Description

SQL injection vulnerability in viewListing.php in linkSpheric 0.74 Beta 6 allows remote attackers to execute arbitrary SQL commands via the listID parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by NoGe · textwebappsphp

https://www.exploit-db.com/exploits/9316

View Code ZIP pw:eip

This exploit demonstrates a SQL injection vulnerability in linkSpheric 0.74 Beta 6 via the 'listID' parameter in viewListing.php. The PoC includes URLs that extract user credentials using a UNION-based SQLi attack.

Classification

Working Poc 95%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: linkSpheric 0.74 Beta 6

No auth needed

Prerequisites: Access to the vulnerable 'viewListing.php' endpoint

MITRE ATT&CK

T1189 - Drive-by Compromise T1505 - Server Software Component

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1

Core References

Exploit, Third Party Advisory exploit x_refsource_exploit-db

http://www.exploit-db.com/exploits/9316

Scores

EPSS 0.0095

EPSS Percentile 56.4%

Details

CWE

CWE-89

Status published

Products (1)

dataspheric/linkspheric 0.74 beta6

Published Oct 01, 2009

Tracked Since Feb 18, 2026