Exploitation Summary
EIP tracks 2 public exploits for CVE-2009-4571. PoCs published by By onestree, Andrea Fabrizi.
AI-analyzed exploit summary The exploit demonstrates SQL injection vulnerabilities in phpshop 2.0 via crafted URL parameters. It includes two distinct injection points, one for database enumeration and another for credential extraction from the auth_user_md5 table.
Description
Multiple SQL injection vulnerabilities in index.php in PhpShop 0.8.1 allow remote attackers to execute arbitrary SQL commands via the (1) module_id parameter in an admin/function_list action, the (2) vendor_id parameter in a vendor/vendor_form action, the (3) module_id parameter in an admin/module_form action, the (4) user_id parameter in an admin/user_form action, the (5) vendor_category_id parameter in a vendor/vendor_category_form action, the (6) user_id parameter in a store/user_form action, the (7) payment_method_id parameter in a store/payment_method_form action, the (8) tax_rate_id parameter in a tax/tax_form action, or the (9) category parameter in a shop/browse action. NOTE: the product_id vector is already covered by CVE-2008-0681.
Exploits (2)
The exploit demonstrates SQL injection vulnerabilities in phpshop 2.0 via crafted URL parameters. It includes two distinct injection points, one for database enumeration and another for credential extraction from the auth_user_md5 table.
This is a writeup detailing multiple SQL injection, blind SQL injection, CSRF, and XSS vulnerabilities in PHPShop 0.8.1. It provides example URLs demonstrating the vulnerabilities but does not include executable exploit code.