Unscored severity · published Nov 2, 2011
CVE-2010-5036
SQL injection vulnerability in addsale.php in iScripts eSwap 2.0 allows remote attackers to execute arbitrary SQL commands via the type parameter
–
CVSS
1.2%
EPSS
No
On KEV
Description
SQL injection vulnerability in addsale.php in iScripts eSwap 2.0 allows remote attackers to execute arbitrary SQL commands via the type parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Eswap · Iscripts
2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-5036
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-5036
Exploit
http://packetstormsecurity.org/1006-exploits/iscriptsewap-sqlxss.txt
securityreason.com
http://securityreason.com/securityalert/8522
Exploit
http://www.exploit-db.com/exploits/13740/
Exploit
http://www.securityfocus.com/bid/40597
Vendor Advisory
http://www.vupen.com/english/advisories/2010/1360
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/59147
More from Eswap
9.8
CVE-2018-11373
iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter
9.8
CVE-2018-11372
iScripts eSwap v2.4 has SQL injection via the wishlistdetailed.php User Panel ToId parameter
8.8
CVE-2018-11470
iScripts eSwap v2.4 has SQL injection via the "search.php" 'Told' parameter in the User Panel
8.8
CVE-2018-10048
iScripts eSwap v2.4 has CSRF via "registration_settings.php" in the Admin Panel
7.2
CVE-2018-10050
iScripts eSwap v2.4 has SQL injection via the "registration_settings.php" ddlFree parameter in the Admin Panel