CVE-2010-5036

iScripts eSwap 2.0 - SQL Injection via addsale.php type Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2010-5036. PoCs published by Sid3^effects.

AI-analyzed exploit summary The document describes SQL injection and XSS vulnerabilities in iScripts eSwap v2.0, providing attack patterns and demo URLs but no functional exploit code. It includes technical details about the vulnerabilities and their locations.

Description

SQL injection vulnerability in addsale.php in iScripts eSwap 2.0 allows remote attackers to execute arbitrary SQL commands via the type parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Sid3^effects · textwebappsphp
https://www.exploit-db.com/exploits/13740

The document describes SQL injection and XSS vulnerabilities in iScripts eSwap v2.0, providing attack patterns and demo URLs but no functional exploit code. It includes technical details about the vulnerabilities and their locations.

Classification
Writeup 90%
Attack Type
Sqli | Xss
Complexity
Trivial
Reliability
Theoretical
Target: iScripts eSwap v2.0
No auth needed
Prerequisites: Access to the vulnerable application
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (6)

Core 6
Core References
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/1360
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/8522
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/59147
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/40597
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/13740/

Scores

EPSS 0.0118
EPSS Percentile 63.6%

Details

CWE
CWE-89
Status published
Products (1)
iscripts/eswap 2.0
Published Nov 02, 2011
Tracked Since Feb 18, 2026