CVE-2009-3968 - Multiple SQL injection vulnerabilities in ITechBids 8.0 allow remote attackers to execute arbitrary SQL commands via the (1) user_id parameter to feedback.php, (2) cate_id parameter to category.php, (3) id parameter to news.php, and (4) productid parameter to itechd.php

Back Back to CVE browser

HIGH

Multiple SQL injection vulnerabilities in ITechBids 8.0 allow remote attackers to execute arbitrary SQL commands via the (1) user_id parameter to feedback.php, (2) cate_id parameter to category.php, (3) id parameter to news.php, and (4) productid parameter to itechd.php

Published Nov 18, 2009

7.5

HIGH

CVSS 2.0

EPSS 0.93%

Description

Multiple SQL injection vulnerabilities in ITechBids 8.0 allow remote attackers to execute arbitrary SQL commands via the (1) user_id parameter to feedback.php, (2) cate_id parameter to category.php, (3) id parameter to news.php, and (4) productid parameter to itechd.php. NOTE: the sellers_othersitem.php, classifieds.php, and shop.php vectors are already covered by CVE-2008-3238.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (2)

http://secunia.com/advisories/36437
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.exploit-db.com/exploits/9497
exploitx_refsource_EXPLOIT-DB

Link	Providers	Tags
http://secunia.com/advisories/36437		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.exploit-db.com/exploits/9497		exploitx_refsource_EXPLOIT-DB

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Nov 18, 2009

Updated Aug 7, 2024

Reserved Nov 18, 2009

Link CVE-2009-3968

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2009-3968

Red Hat

Severity n/a

Public date n/a

Links CVE-2009-3968