CVE-2009-4477

Xstate Real Estate 1.0 - SQL Injection

Title source: llm

Description

SQL injection vulnerability in page.html in Xstate Real Estate 1.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Moudi · textwebappsphp

https://www.exploit-db.com/exploits/9565

View Code ZIP pw:eip

References (4)

[Vendor Advisory] http://secunia.com/advisories/36529

[Exploit, Third Party Advisory] http://www.exploit-db.com/exploits/9565

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/52968

[Third Party Advisory, VDB Entry] http://osvdb.org/57670

Scores

EPSS 0.0084

EPSS Percentile 74.5%

Classification

CWE

CWE-89

Status draft

Affected Products (1)

xstate/real_estate

Timeline

Published Dec 30, 2009

Tracked Since Feb 18, 2026