CVE-2009-4155

Eshopbuilde CMS - SQL Injection

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2009-4155 has a selected CVSS score of 7.5; EIP currently links 1 catalogued exploit.

Description

Multiple SQL injection vulnerabilities in Eshopbuilde CMS allow remote attackers to execute arbitrary SQL commands via the sitebid parameter to (1) home-f.asp and (2) opinions-f.asp; (3) sitebid, (4) id, (5) secText, (6) client-ip, and (7) G_id parameters to more-f.asp; (8) sitebid, (9) id, (10) ma_id, (11) mi_id, (12) secText, (13) client-ip, and (14) G_id parameters to selectintro.asp; (15) sitebid, (16) secText, (17) adv_code, and (18) client-ip parameters to advcount.asp; (19) sitebid, (20) secText, (21) Grp_Code, (22) _method, and (23) client-ip parameters to advview.asp; and (24) sitebid, (25) secText, (26) newsId, and (27) client-ip parameters to dis_new-f.asp.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

Proofs of concept

1

Catalogued exploits

ExploitDBEshopbuilde CMS - SQL InjectionExploitDB exploitby IsfahanScanner1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a text writeup that lists multiple SQL injection entry points in Eshopbuilde CMS. It provides example URLs with test payloads (e.g., '@@version', 'JyI%3D', '%00') that are designed to detect or validate the presence of SQL injection vulnerabilities by observing application responses, not to extract data or gain access. No exploit code is present.

Backdoor review

No backdoor observed in reviewed code

The supplied text is a plain-text vulnerability disclosure describing SQL injection vectors in Eshopbuilde CMS. It contains no executable code, no instructions for the reader to run anything, and no concealed or deceptive payload. The content is limited to parameter names, example URLs, and remediation advice.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesEnglish
Target softwareEshopbuilde CMS
Attack typesSQL Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains only example URLs with test payloads (e.g., '@@version', 'JyI%3D', '%00') that are typical of vulnerability detection/validation, not exploitation. It lacks any code to extract data, establish a shell, or perform post-exploitation actions. The content is a writeup describing injection points, but the provided payloads function as a scanner to confirm SQL injection.

exploits/asp/webapps/10253.txt:26-28exploits/asp/webapps/10253.txt:24-68

Requirements

  • Target running Eshopbuilde CMS with accessible vulnerable ASP scriptsexploits/asp/webapps/10253.txt:24-28

Observed behavior

  • Provides example HTTP requests with SQL injection test strings in parameters like sitebid to detect vulnerabilityexploits/asp/webapps/10253.txt:26-28
  • Lists multiple vulnerable scripts and parameters without providing data extraction or command execution logicexploits/asp/webapps/10253.txt:24-68
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Disclosure
Payload withheldThe file documents multiple SQL injection points across several ASP scripts, consistent with the associated CVE-2009-4155.exploits/asp/webapps/10253.txt:3exploits/asp/webapps/10253.txt:24-68
Review boundaries

What the analysis did not establish

  • Only the single text file from ExploitDB is analyzed; no external tools, libraries, or referenced resources are expanded.
  • The artifact does not include any executable code or scripts; classification is based solely on the provided text content.
  • Only the single text file (10253.txt) was reviewed; no external resources, tools, or referenced URLs were fetched or analyzed.
  • The review does not assess the correctness or completeness of the vulnerability disclosure.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

2