CVE-2008-2190

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 2.2%

exploitation probability

2.2%top 19% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

SQL injection vulnerability in index.php in Online Rent (aka Online Rental Property Script) 4.5 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter. NOTE: it was later reported that 5.0 and earlier are also affected.

Affected products

n/a · n/a

public PoCs found — 2✓ VexDay Proof

cve_reference✓ VexDay Proofwww.exploit-db.com/exploits/5542 cve_referencewww.exploit-db.com/exploits/8711unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://advisories.echo.or.id/adv/adv91-K-159-2008.txt http://secunia.com/advisories/30090 http://secunia.com/advisories/35147 http://securityreason.com/securityalert/3875 https://exchange.xforce.ibmcloud.com/vulnerabilities/42191 https://www.exploit-db.com/exploits/5542 https://www.exploit-db.com/exploits/8711 http://www.securityfocus.com/archive/1/491607/100/0/threaded http://www.securityfocus.com/archive/1/491816/100/0/threaded http://www.securityfocus.com/bid/29052 http://www.securityfocus.com/bid/35005 http://www.vupen.com/english/advisories/2009/1366