SQL Injection Vulnerability in AJSquare AJ Auction Pro Web Application
CVE-2008-2860

Currently unrated

Key Information:

Vendor

Aj Square

Status
Aj Auction
Vendor
CVE Published:
25 June 2008

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2008-2860?

The AJSquare AJ Auction Pro web application version 2.0 has a vulnerability in the category.php file that allows remote attackers to execute arbitrary SQL commands. This issue arises from an inadequate validation of the 'cate_id' parameter, which can be manipulated by malicious users to gain unauthorized access to the underlying database, potentially leading to data exposure or other harmful outcomes.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2008-2860 - Proof of Concept

References

http://www.securityfocus.com/bid/29839
vdb-entryx_refsource_BID
https://exchange.xforce.ibmcloud.com/vulnerabilities/43218
vdb-entryx_refsource_XF
https://www.exploit-db.com/exploits/5867
exploitx_refsource_EXPLOIT-DB

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.